Skip to main content
In this guide you’ll create a draft security advisory inside a repository that has GitHub Advanced Security (GHAS) enabled. Draft advisories let maintainers prepare disclosure details, coordinate private fixes, and request a CVE before publishing. Back in my GHAS Guided Demo repository, the Security and Quality → Overview page shows the repository’s security features and their current status. For this repository the Security policy is set to Disabled. Creating a security policy is outside the scope of this article; instead we’ll focus on drafting a security advisory.
A GitHub repository "Security and quality" overview page for game-devstudio/ghas-guardrail-demo. It lists security features and their statuses (e.g., Security policy: Disabled; Security advisories, Dependabot, code scanning and secret scanning: Enabled).

​
Where to start

  1. In the repository, go to Security → Security advisories.
  2. If there are no published advisories, click New draft security advisory to open the advisory form.
  3. Fill in the fields describing the vulnerability, affected products and versions, severity, and credits. You can save the advisory as a draft and update the details later.
Use the table below as a quick reference for the common fields you’ll fill in when creating a draft advisory.

​
Filling out severity: use CVSS as a calculator

The advisory form exposes controls that generate a CVSS vector string and numeric score dynamically. Treat these controls as a calculator to justify severity — don’t guess a score.
  • Network attack vector + high impacts → e.g., 9.8 (Critical).
  • Physical or higher privilege requirements usually lower the score.
  • Adjust Confidentiality, Integrity, Availability (CIA) metrics to reflect real-world impact.
Example: a remote code execution that can be triggered over the network with full integrity and confidentiality loss typically yields a critical CVSS score.
A screenshot of GitHub's "Create draft security advisory" form showing an npm package's affected and patched versions, severity/CVSS vector string, and weaknesses. A credits dropdown is expanded (listing roles like Analyst, Finder, Reporter, etc.) and the "Create draft security advisory" button is visible.

​
After creating the draft

Click Create draft security advisory when you’ve completed the fields. The advisory is saved in draft state and you’ll have a few important options for handling fixes and disclosure:
  • Create a temporary private fork to build and test a private patch. This keeps fix commits out of the public repository until disclosure.
  • Request a CVE ID from GitHub during submission if you need an official identifier.
  • When ready to publish, submit the advisory. GitHub will review and—if appropriate—coordinate publication to the GitHub Advisory Database (github.com/advisories).

​
Best practices and checklist

  • Use the CVSS controls to produce a reproducible severity justification.
  • Include reproduction steps, exploitability details, and clear mitigation or patch instructions.
  • Add CWE identifiers and external references to improve clarity and discoverability.
  • Provide explicit affected versions and the exact patched version string.
  • Credit contributors by role; this helps audit trails and recognition.
  • Consider private testing via a temporary private fork before making fixes public.
Draft advisories let you prepare full disclosure details and coordinate private fixes (via a temporary private fork) before public publication. Use the CVSS vector controls to calculate and justify the severity rather than guessing a score.
This workflow covers the typical steps to create and manage a draft security advisory using GitHub’s security advisory features. Once submitted, GitHub reviews and processes advisories according to the options you selected (CVE request, private fixes, publication).

Watch Video