GitHub Implements Daily Rate Limits on Private Vulnerability Reports

• •GitHub has introduced daily rate limits on private vulnerability reports.
• •The limits are designed to reduce low-quality and automated submissions.
• •Repository administrators can customize reporting limits and allow-list trusted researchers.

GitHub has announced the introduction of daily rate limits on private vulnerability reports to combat the increasing volume of low-quality and automated submissions. These limits apply both to individual repositories and across the platform, though specific thresholds have not been disclosed. Repository administrators can set custom limits and allow-list trusted researchers to bypass these restrictions. The changes aim to alleviate the burden on open-source maintainers, who are overwhelmed by reports that obscure vulnerabilities. GitHub stated that the new limits will not affect existing bug reports, allowing ongoing investigations into previously submitted advisories. The decision reflects a growing concern over the scalability of traditional security-disclosure workflows in the face of AI-generated reports. This initiative is available for public repositories with Private Vulnerability Reporting enabled on GitHub Free, Pro, Team, and Enterprise Cloud.