GitHub has officially introduced daily rate limits for its private vulnerability reporting feature in an effort to combat automated submissions and low-quality security disclosures. According to GitHub, a growing surge in automated vulnerability reports has made it increasingly challenging for open-source project maintainers to triage notifications and identify legitimate security concerns among non-actionable noise.
Daily Caps and Allow-Lists
The new system caps how many private vulnerability reports a single user account can submit within a twenty-four hour period. These restrictions operate at both the individual repository level and globally across the entire GitHub platform. When a user reaches the daily submission cap, the interface prompts them to try submitting their report at a later time. Crucially, these rate limits apply strictly to the creation of brand-new vulnerability reports. Ongoing discussions, follow-up communications, and comments on already established security advisories remain completely unaffected by the cap.
To provide flexibility, repository administrators can now define custom daily submission thresholds tailored to the specific needs of their projects. Furthermore, to prevent unnecessary friction for trusted security researchers who regularly contribute valid disclosures, administrators have the option to add designated accounts to an allow-list, fully exempting those individuals from any rate-limiting constraints.
Availability and Configuration Options
Maintainers can configure these new rate-limiting settings directly through their repository dashboard by navigating to the security settings and accessing the Private Vulnerability Reporting management panel. This administrative feature is available for public repositories that have enabled private vulnerability reporting across multiple platform tiers, including GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud plans. By implementing these controls, maintainers can better protect their workflows while maintaining open channels for critical flaw disclosures.
AI-generated editorial illustration; not a documentary photograph.
Source: Rate limits for private vulnerability reports
SIGNAL TITANS
Leave a Reply