Innersource security advisories go GA: a private channel for private vulns

Short summary

GitHub made innersource security advisories generally available on July 8, letting enterprises publish private vulnerability advisories scoped to their own repositories with Dependabot-driven fan-out. A REST API enables automation so scanners and SBOM tooling can file advisories programmatically. The feature requires GitHub Advanced Security on enterprise plans and only works if teams actively maintain the advisory feed.

• •GitHub GA'd innersource security advisories for enterprise customers, scoped to enterprise-owned repos
• •Dependabot delivers alerts and update PRs to affected internal repos automatically
• •REST API allows automation tooling to create, update, and withdraw advisories as first-class objects

Generated with AI, which can make mistakes.