Rate limits for private vulnerability reports
Rate limits now cap how many new vulnerability reports a single account can submit, helping maintainers avoid being overwhelmed by low-quality and automated reports.
Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub. This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you.
With this update:
- Private vulnerability reporting now applies daily per-user rate limits to new reports.
- Reporters who reach a limit see a message asking them to try again later.
- Limits apply only to new reports. Comments on existing advisories aren’t affected.
- Repository administrators can set a custom daily overall reporting limit for their repository.
- Repository administrators can add trusted reporters to an allow list so they’re never rate limited.
To configure these settings, go to your repository’s settings, select Advanced Security, and click Settings next to “Private vulnerability reporting.”
This is available for public repositories with private vulnerability reporting enabled on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.
Learn more in our docs about configuring private vulnerability reporting.
The post Rate limits for private vulnerability reports appeared first on The GitHub Blog.
Source: original entry ↗
More from GitHub
Follow GitHub to get its new changes in your feed and email digest.
Improved detection for withdrawn Dependabot alerts
Dependabot now provides improved detection for withdrawn alerts that are no longer valid due to advisory or vulnerability changes. This makes it easier to identify and manage alerts that have been removed.
Search and filter for budgets now available
The Budgets and alerts page in GitHub billing settings now displays all budgets in a single searchable and filterable list, making it easier to manage multiple budgets.
Code scanning AI Scan metrics in security overview
Organization and enterprise administrators can now view metrics showing AI Scan findings generated and resolved in the security overview dashboard, providing visibility into the impact of AI-powered code scanning on pull requests.