Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples. | 1 | -- Reporting (src/advisories.rs): a repository's security advisories, and |
| 2 | -- the vulnerability reports people send its maintainers privately. | |
| 3 | ||
| 4 | -- An advisory: what the repository says about a vulnerability in what it | |
| 5 | -- ships. Drafts are the maintainers'; published ones anyone who can see | |
| 6 | -- the repository reads. | |
| 7 | -- state: draft | published | withdrawn | |
| 8 | -- severity: critical | high | medium | low | |
| 9 | -- credits: JSON array of strings | |
| The advisories a repository publishes live in security_advisories: the security database already had an advisories table, its cache of OSV advisories, so the migration for repository advisories stopped at its first statement on deploy. | 10 | CREATE TABLE security_advisories ( |
| Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples. | 11 | id TEXT PRIMARY KEY, |
| 12 | g1tsa_id TEXT NOT NULL UNIQUE, | |
| 13 | repo_id TEXT NOT NULL, | |
| 14 | title TEXT NOT NULL, | |
| 15 | description TEXT NOT NULL DEFAULT '', | |
| 16 | severity TEXT NOT NULL, | |
| 17 | cvss_vector TEXT, | |
| 18 | cvss_score REAL, | |
| 19 | cve_id TEXT, | |
| 20 | ecosystem TEXT, | |
| 21 | package TEXT, | |
| 22 | affected_versions TEXT, | |
| 23 | patched_versions TEXT, | |
| 24 | state TEXT NOT NULL DEFAULT 'draft', | |
| 25 | credits TEXT NOT NULL DEFAULT '[]', | |
| 26 | report_id TEXT, | |
| 27 | created_by TEXT NOT NULL, | |
| 28 | created_at TEXT NOT NULL, | |
| 29 | updated_at TEXT NOT NULL, | |
| 30 | published_at TEXT, | |
| 31 | withdrawn_at TEXT | |
| 32 | ); | |
| The advisories a repository publishes live in security_advisories: the security database already had an advisories table, its cache of OSV advisories, so the migration for repository advisories stopped at its first statement on deploy. | 33 | CREATE INDEX security_advisories_repo ON security_advisories (repo_id, state, created_at); |
| Security tells people the way they can live with. Each scan publishes one summary event per alert type (secret_scanning_alert.summary, code_scanning_alert.summary, vulnerability_alert.summary: what it opened, by severity, what it fixed, what is open now, the worst new alert and the newest one's title, with the owners and security managers to tell) beside the per-alert events webhooks keep, so the inbox holds one thread per repository and alert type that the next scan brings up to date instead of one item per finding, and the ids are capped at 200 while the counts are not. Critical and high alerts and a refused push reach the inbox at once (and toast like a mention, as the new security notification kind); medium and low wait for each person's security digest, one inbox item and email per workspace, daily or weekly as they choose in their notification settings, at once, or never; a scan that opened nothing refreshes the thread quietly ("2 of 3 fixed") and marks it done when nothing is left open; and security alerts are emailed by default. A repository can turn alerts for secrets found in its history off while push protection stays on. Reporting arrives: security advisories (G1TSA ids, drafts published and withdrawn by Admins and security managers, visible to anyone who can see the repository once published) and private vulnerability reporting (a repository setting; anyone who can see it may report, signed out with an email on a public one, five a day each, and the owners and security managers are told at once), each with its RPC methods, REST routes under /repos/{owner}/{name}/security/advisories and /security/reports, MCP actions, scopes and reference examples. | 34 | |
| 35 | -- A report: what someone told the maintainers privately, when the | |
| 36 | -- repository takes private vulnerability reports. The reporter is a | |
| 37 | -- username when signed in, else the address they gave; reporter_key is | |
| 38 | -- either, lowercased, for the limit on how many one person files a day. | |
| 39 | -- state: new | accepted | declined | |
| 40 | CREATE TABLE vulnerability_reports ( | |
| 41 | id TEXT PRIMARY KEY, | |
| 42 | repo_id TEXT NOT NULL, | |
| 43 | reporter TEXT, | |
| 44 | reporter_email TEXT, | |
| 45 | reporter_key TEXT NOT NULL, | |
| 46 | title TEXT NOT NULL, | |
| 47 | description TEXT NOT NULL, | |
| 48 | severity TEXT, | |
| 49 | state TEXT NOT NULL DEFAULT 'new', | |
| 50 | advisory_id TEXT, | |
| 51 | created_at TEXT NOT NULL, | |
| 52 | reviewed_by TEXT, | |
| 53 | reviewed_at TEXT, | |
| 54 | review_note TEXT | |
| 55 | ); | |
| 56 | CREATE INDEX vulnerability_reports_repo ON vulnerability_reports (repo_id, state, created_at); | |
| 57 | CREATE INDEX vulnerability_reports_reporter ON vulnerability_reports (repo_id, reporter_key, created_at); |
