> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo GitHub Security Advisory

> Guide to creating and managing draft GitHub security advisories, covering form fields, CVSS severity, private fixes, CVE requests, and best practices for disclosure and credits.

In this guide you'll create a draft security advisory inside a repository that has GitHub Advanced Security (GHAS) enabled. Draft advisories let maintainers prepare disclosure details, coordinate private fixes, and request a CVE before publishing.

Back in my GHAS Guided Demo repository, the Security and Quality → Overview page shows the repository’s security features and their current status. For this repository the Security policy is set to Disabled. Creating a security policy is outside the scope of this article; instead we'll focus on drafting a security advisory.

![A GitHub repository "Security and quality" overview page for game-devstudio/ghas-guardrail-demo. It lists security features and their statuses (e.g., Security policy: Disabled; Security advisories, Dependabot, code scanning and secret scanning: Enabled).](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GitHub-Security-Advisory/ghas-guardrail-demo-security-overview.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=f6d45b5d132b951cd4267c7a8b9ba8d7)

## Where to start

1. In the repository, go to Security → Security advisories.
2. If there are no published advisories, click **New draft security advisory** to open the advisory form.
3. Fill in the fields describing the vulnerability, affected products and versions, severity, and credits. You can save the advisory as a draft and update the details later.

## Key fields and recommended values

Use the table below as a quick reference for the common fields you’ll fill in when creating a draft advisory.

| Field | Purpose | Example / guidance |
| - | -: | - |
| Title & CVE request | Short summary and whether you want GitHub to request a CVE on your behalf. | `Remote Code Execution via Path Traversal in File Upload Handler` — request CVE if you plan to publish. |
| Description & Impact | Explain the vulnerability, exploitation scenarios, impact, and mitigation. | Include reproduction steps, links to patches, and workarounds. |
| Affected product(s) | Identify package ecosystem and package name(s). | Ecosystem: `npm`; Package: `demo-express-npm`. If GitHub registry lookup fails, you can still enter the package name. |
| Affected versions & Patched version | Versions impacted and the version containing the fix. | Affected: `< 2.4.1` — Patched: `2.4.2` |
| Severity / CVSS vector | Use the CVSS controls to generate an objective score and vector string. | Choose network vs local vector, privileges required, impact on confidentiality/integrity/availability. |
| Weakness & References | Add CWE identifiers and external references for context. | Example: `CWE-22` (Path Traversal), reference vendor advisories or CVE entries. |
| Credits | Acknowledge contributors and roles (finder, analyst, developer, reviewer, etc.). | Add multiple roles such as Finder, Reporter, Remediation Developer, Verifier. |

## Filling out severity: use CVSS as a calculator

The advisory form exposes controls that generate a CVSS vector string and numeric score dynamically. Treat these controls as a calculator to justify severity — don’t guess a score.

* Network attack vector + high impacts → e.g., 9.8 (Critical).
* Physical or higher privilege requirements usually lower the score.
* Adjust Confidentiality, Integrity, Availability (CIA) metrics to reflect real-world impact.

Example: a remote code execution that can be triggered over the network with full integrity and confidentiality loss typically yields a critical CVSS score.

![A screenshot of GitHub's "Create draft security advisory" form showing an npm package's affected and patched versions, severity/CVSS vector string, and weaknesses. A credits dropdown is expanded (listing roles like Analyst, Finder, Reporter, etc.) and the "Create draft security advisory" button is visible.](https://mintcdn.com/kodekloud-c4ac6d9a/TlnHw4JjIHBx3Cta/images/GitHub-Administration-Certification/Security-and-Compliance/Demo-GitHub-Security-Advisory/github-create-draft-advisory-npm-credits.jpg?fit=max\&auto=format\&n=TlnHw4JjIHBx3Cta\&q=85\&s=bbfd0db584b85232cff8a1819ff02a25)

## After creating the draft

Click **Create draft security advisory** when you’ve completed the fields. The advisory is saved in draft state and you’ll have a few important options for handling fixes and disclosure:

* Create a temporary private fork to build and test a private patch. This keeps fix commits out of the public repository until disclosure.
* Request a CVE ID from GitHub during submission if you need an official identifier.
* When ready to publish, submit the advisory. GitHub will review and—if appropriate—coordinate publication to the GitHub Advisory Database ([github.com/advisories](https://github.com/advisories)).

## Best practices and checklist

* Use the CVSS controls to produce a reproducible severity justification.
* Include reproduction steps, exploitability details, and clear mitigation or patch instructions.
* Add CWE identifiers and external references to improve clarity and discoverability.
* Provide explicit affected versions and the exact patched version string.
* Credit contributors by role; this helps audit trails and recognition.
* Consider private testing via a temporary private fork before making fixes public.

Draft advisories let you prepare full disclosure details and coordinate private fixes (via a temporary private fork) before public publication. Use the CVSS vector controls to calculate and justify the severity rather than guessing a score.

## Useful links and references

* CVE (CVE Program): [https://cve.mitre.org/](https://cve.mitre.org/)
* CVSS (FIRST): [https://www.first.org/cvss/](https://www.first.org/cvss/)
* CWE (MITRE): [https://cwe.mitre.org/](https://cwe.mitre.org/)
* GitHub Advisory Database: [https://github.com/advisories](https://github.com/advisories)

This workflow covers the typical steps to create and manage a draft security advisory using GitHub’s security advisory features. Once submitted, GitHub reviews and processes advisories according to the options you selected (CVE request, private fixes, publication).

> [card] [Watch Video](https://learn.kodekloud.com/user/courses/github-administration-certification/module/d477d0b2-5ca0-43b2-aed7-7d82887400f7/lesson/765fb775-eb59-421f-a7d3-0af464fa3b07)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.