Rate limits for private vulnerability reports

What broke in Rate limits for private vulnerability reports

GitHub launched a new rate-limiting feature designed to restrict the submission of private vulnerability reports on its platform. This release targets the growing problem of spam and automated submissions that target open-source repositories. By introducing a cap on the number of new reports a single user account can submit within a given timeframe, the platform aims to reduce the noise generated by low-quality and automated security filings. Maintainers of open-source projects can now

Back to changelog Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub.

Who is exposed by Rate limits for private vulnerability reports

This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you. With this update: Private vulnerability reporting now applies daily per-user rate limits to new reports.

What to do now about Rate limits for private vulnerability reports

Reporters who reach a limit see a message asking them to try again later. See the full write-up from GitHub Changelog via the source link for quotes and complete context.

How the Rate limits for private vulnerability reports issue works

Repository administrators can set a custom daily overall reporting limit for their repository. Repository administrators can add trusted reporters to an allow list so they’re never rate limited.

What is still unknown about Rate limits for private vulnerability

Learn more in our docs about configuring private vulnerability reporting.