GitHub: Privately report a security vulnerability

GitHub securityAdvisories.securityAdvisoriesCreatePrivateVulnerabilityReport: arguments, response, policy and SDK examples.

← Security advisories operations · Get started

Operation github.security_advisories_create_private_vulnerability_report

Provider route: POST /repos/{owner}/{repo}/security-advisories/reports. Alter supplies the connection’s credentials and routing.

Call through Alter

Install @alter-ai/sdk @alter-ai/github with npm, or alter-sdk-github with pip. Supply your connected customer’s grant ID and the arguments described below.

import { App } from "@alter-ai/sdk";
import { GitHubIntegration } from "@alter-ai/github";

async function execute(input: Parameters<GitHubIntegration["securityAdvisories"]["securityAdvisoriesCreatePrivateVulnerabilityReport"]>[0]) {
  const app = new App({ apiKey: process.env.ALTER_API_KEY! });
  try {
    const provider = new GitHubIntegration(app, { grantId: process.env.PROVIDER_GRANT_ID! });
    const call = await provider.securityAdvisories.securityAdvisoriesCreatePrivateVulnerabilityReport(input);
    const result = await call.wait();
    return result.bodyJson();
  } finally {
    await app.close();
  }
}

import os
from alter_sdk import App
from alter_sdk_github import GitHubIntegration

async def execute(arguments):
    async with App(api_key=os.environ["ALTER_API_KEY"]) as app:
        provider = GitHubIntegration(app, {"grant_id": os.environ["PROVIDER_GRANT_ID"]})
        call = await provider.security_advisories.security_advisories_create_private_vulnerability_report(arguments)
        result = await call.wait()
        return result.body_json()

Input

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`path`	object	Required within parent	Additional keys: not allowed
`path.owner`	string	Required within parent
`path.repo`	string	Required within parent
`body`	Model	Required within parent	Expand Privately report a security vulnerability — request body — body

Referenced models: Privately report a security vulnerability — request body — body

Response

Response media type: application/json. The table describes the pinned successful response. Referenced models link to their complete fields.

Field	Type	Presence	Description and constraints
`$`	Model	Root	Expand Get a repository security advisory — response body

Referenced models: Get a repository security advisory — response body

Schemas

10 more schemas are linked from the tables above, on the schema pages.

Get a repository security advisory — response body

Field	Type	Presence	Description and constraints
`$`	object	Root	A repository security advisory. Additional keys: not allowed
`author`	JSON	Required within parent
`author (anyOf 1)`	JSON	Alternative	The author of the advisory. Read only: true
`author (anyOf 1) (allOf 1)`	Model	All variants apply	Expand List users — response body — item
`author (anyOf 2)`	null	Alternative
`closed_at`	JSON	Required within parent
`closed_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was closed, in ISO 8601 format. Format: date-time Read only: true
`closed_at (anyOf 2)`	null	Alternative
`collaborating_teams`	JSON	Required within parent
`collaborating_teams (anyOf 1)`	array	Alternative	A list of teams that collaborate on the advisory.
`collaborating_teams (anyOf 1)[]`	Model	Each item	Expand List teams — response body — item
`collaborating_teams (anyOf 2)`	null	Alternative
`collaborating_users`	JSON	Required within parent
`collaborating_users (anyOf 1)`	array	Alternative	A list of users that collaborate on the advisory.
`collaborating_users (anyOf 1)[]`	Model	Each item	Expand List users — response body — item
`collaborating_users (anyOf 2)`	null	Alternative
`created_at`	JSON	Required within parent
`created_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was created, in ISO 8601 format. Format: date-time Read only: true
`created_at (anyOf 2)`	null	Alternative
`credits`	JSON	Required within parent
`credits (anyOf 1)`	array	Alternative
`credits (anyOf 1)[]`	object	Each item
`credits (anyOf 1)[].login`	string	Optional	The username of the user credited.
`credits (anyOf 1)[].type`	string	Optional	The type of credit the user is receiving. Known values: analyst, finder, reporter, coordinator, remediation_developer, remediation_reviewer, remediation_verifier, tool, sponsor, other
`credits (anyOf 2)`	null	Alternative
`credits_detailed`	JSON	Required within parent
`credits_detailed (anyOf 1)`	array	Alternative	Read only: true
`credits_detailed (anyOf 1)[]`	Model	Each item	Expand Get a repository security advisory — response body — credits detailed array item
`credits_detailed (anyOf 2)`	null	Alternative
`cve_id`	JSON	Required within parent
`cve_id (anyOf 1)`	string	Alternative	The Common Vulnerabilities and Exposures (CVE) ID.
`cve_id (anyOf 2)`	null	Alternative
`cvss_severities`	Model	Optional	Expand Get a global security advisory — response body — cvss severities
`cwe_ids`	JSON	Required within parent
`cwe_ids (anyOf 1)`	array	Alternative	A list of only the CWE IDs.
`cwe_ids (anyOf 1)[]`	string	Each item
`cwe_ids (anyOf 2)`	null	Alternative
`cwes`	JSON	Required within parent
`cwes (anyOf 1)`	array	Alternative	Read only: true
`cwes (anyOf 1)[]`	object	Each item
`cwes (anyOf 1)[].cwe_id`	string	Required within parent	The Common Weakness Enumeration (CWE) identifier.
`cwes (anyOf 1)[].name`	string	Required within parent	The name of the CWE. Read only: true
`cwes (anyOf 2)`	null	Alternative
`description`	JSON	Required within parent
`description (anyOf 1)`	string	Alternative	A detailed description of what the advisory entails. Maximum length: 65535
`description (anyOf 2)`	null	Alternative
`ghsa_id`	string	Required within parent	The GitHub Security Advisory ID. Read only: true
`html_url`	string	Required within parent	The URL for the advisory. Format: uri Read only: true
`identifiers`	array	Required within parent	Read only: true
`identifiers[]`	object	Each item
`identifiers[].type`	string	Required within parent	The type of identifier. Known values: CVE, GHSA
`identifiers[].value`	string	Required within parent	The identifier value.
`private_fork`	JSON	Required within parent
`private_fork (anyOf 1)`	JSON	Alternative	A temporary private fork of the advisory's repository for collaborating on a fix. Read only: true
`private_fork (anyOf 1) (allOf 1)`	Model	All variants apply	Expand List repositories for a user migration — response body — item
`private_fork (anyOf 2)`	null	Alternative
`published_at`	JSON	Required within parent
`published_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was published, in ISO 8601 format. Format: date-time Read only: true
`published_at (anyOf 2)`	null	Alternative
`publisher`	JSON	Required within parent
`publisher (anyOf 1)`	JSON	Alternative	The publisher of the advisory. Read only: true
`publisher (anyOf 1) (allOf 1)`	Model	All variants apply	Expand List users — response body — item
`publisher (anyOf 2)`	null	Alternative
`severity`	JSON	Required within parent
`severity (anyOf 1)`	string	Alternative	The severity of the advisory. Known values: critical, high, medium, low
`severity (anyOf 2)`	null	Alternative
`state`	string	Required within parent	The state of the advisory. Known values: published, closed, withdrawn, draft, triage
`submission`	JSON	Required within parent
`submission (anyOf 1)`	object	Alternative	Read only: true
`submission (anyOf 1).accepted`	boolean	Required within parent	Whether a private vulnerability report was accepted by the repository's administrators. Read only: true
`submission (anyOf 2)`	null	Alternative
`summary`	string	Required within parent	A short summary of the advisory. Maximum length: 1024
`updated_at`	JSON	Required within parent
`updated_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was last updated, in ISO 8601 format. Format: date-time Read only: true
`updated_at (anyOf 2)`	null	Alternative
`url`	string	Required within parent	The API URL for the advisory. Format: uri Read only: true
`vulnerabilities`	JSON	Required within parent
`vulnerabilities (anyOf 1)`	array	Alternative
`vulnerabilities (anyOf 1)[]`	Model	Each item	Expand Get a repository security advisory — response body — vulnerabilities array item
`vulnerabilities (anyOf 2)`	null	Alternative
`withdrawn_at`	JSON	Required within parent
`withdrawn_at (anyOf 1)`	string	Alternative	The date and time of when the advisory was withdrawn, in ISO 8601 format. Format: date-time Read only: true
`withdrawn_at (anyOf 2)`	null	Alternative

Referenced models: Get a global security advisory — response body — cvss severities, Get a repository security advisory — response body — credits detailed array item, Get a repository security advisory — response body — vulnerabilities array item, List repositories for a user migration — response body — item, List users — response body — item, List teams — response body — item

Privately report a security vulnerability — request body — body

Field	Type	Presence	Description and constraints
`$`	object	Root	Additional keys: not allowed
`cvss_vector_string`	JSON	Optional
`cvss_vector_string (anyOf 1)`	string	Alternative	The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`.
`cvss_vector_string (anyOf 2)`	null	Alternative
`cwe_ids`	JSON	Optional
`cwe_ids (anyOf 1)`	array	Alternative	A list of Common Weakness Enumeration (CWE) IDs.
`cwe_ids (anyOf 1)[]`	string	Each item
`cwe_ids (anyOf 2)`	null	Alternative
`description`	string	Required within parent	A detailed description of what the advisory impacts. Maximum length: 65535
`severity`	JSON	Optional
`severity (anyOf 1)`	string	Alternative	The severity of the advisory. You must choose between setting this field or `cvss_vector_string`. One of: critical, high, medium, low
`severity (anyOf 2)`	null	Alternative
`start_private_fork`	boolean	Optional	Whether to create a temporary private fork of the repository to collaborate on a fix. The fork is created only if you are permitted to create one; otherwise, this parameter is ignored and the report is still created. Default: false
`summary`	string	Required within parent	A short summary of the advisory. Maximum length: 1024
`vulnerabilities`	JSON	Optional
`vulnerabilities (anyOf 1)`	array	Alternative	An array of products affected by the vulnerability detailed in a repository security advisory.
`vulnerabilities (anyOf 1)[]`	Model	Each item	Expand Create a repository security advisory — request body — body vulnerabilities item
`vulnerabilities (anyOf 2)`	null	Alternative

Referenced models: Create a repository security advisory — request body — body vulnerabilities item

Policy, approvals and errors

SDK function policy ID: github.security_advisories_create_private_vulnerability_report. Catalog operation: security-advisories/create-private-vulnerability-report. Rules can name either ID; function rules distinguish managed calls and conservatively cover raw calls sharing the route. Existing grant permissions and policy rules apply. wait() returns an immediate result or waits for a required approval; it never approves the request itself. Persist the approval ID to resume after a restart.

Provider errors retain their response; JSON decoding raises ProviderAPIError for provider failures. ManagedOperationError identifies contract/input/retention errors. See error handling and provider-specific behavior. Sensitive input may be refused before approval storage. A decoding error never resubmits a write.

Pinned headers: {"X-GitHub-Api-Version": "2026-03-10", "User-Agent": "Alter", "Accept": "application/vnd.github+json"}

Official provider source

Report an issue with this page