GitHub Slams the Brakes on Private Vulnerability Reports

GitHub has implemented new limits on private vulnerability reports to address the overwhelming influx of automated and low-quality submissions. This move reflects the company's acknowledgment that human maintainers struggle to handle the massive volume of reports while still managing legitimate, high-quality disclosures. The new daily rate limits on private vulnerability reports aim to give maintainers time to focus on the most relevant and high-quality reports without completely shutting off the private disclosure channels for genuine researchers.

These restrictions don't apply to existing reports and allow repository administrators to create custom limits and exempt trusted contributors from the caps. GitHub also introduced structured forms for private vulnerability reports, which require maintainers to request additional information such as reproducible proof of concept, aiming to improve the signal-to-noise ratio at the intake stage.