GitHub has released a public preview of new REST API endpoints that allow developers to programmatically read, create, and edit comments on repository security advisories. The update covers advisories generated from private vulnerability reports, bringing long-sought programmatic access to discussion context that was previously restricted to the GitHub web interface.
Automating Security Triage and Audits
The new endpoints enable teams to list comments on a repository security advisory—including filtering by update time—as well as retrieve individual comments, post new responses, and update existing entries. To help developers detect active discussions, GitHub added comment counts directly to repository security advisory responses, alongside global advisory responses for linked advisories.
By opening discussion threads to API calls, organization security teams can automate triage notes, export advisory logs for compliance audits, and streamline migration pipelines. These capabilities allow developers to align vulnerability management workflows with existing automation built around standard GitHub issues and pull requests.
Access Rules and Limitations
Access to advisory comments strictly adheres to existing repository security advisory permissions. API calls require permission to view the parent advisory alongside the appropriate read or write token scope. Non-collaborators are barred from viewing internal comments, and confidential comments are excluded from these REST responses entirely.
GitHub noted that deleting comments via the API is not supported in this initial release. The public preview is available for public repositories across GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud plans.
AI-generated editorial illustration; not a documentary photograph.
Source: Repository security advisory comments API in public preview
SIGNAL TITANS
Leave a Reply