Who Can Read Restricted Advisory Notes?
On 2 October 2026, GitHub introduced a restricted discussion option for repository security advisories. Only repository writers see these notes. A reporter or invited collaborator without that permission receives neither the notes nor alerts.
Removing write permission also removes visibility. A submitted note cannot switch between restricted and ordinary audiences. Reads generate audit events.
Check audience and archives
Review everyone who can write before posting sensitive material; use a smaller channel if that group is too broad. Neither public API, REST nor GraphQL, returns this discussion, so API-based archives may omit context.
Eligibility covers public repositories where private vulnerability reporting is enabled, across Free, Pro, Team and Enterprise Cloud.
Keep shared decisions usable
The advisory workflow lets maintainers and reporters establish impact, organise remediation and prepare disclosure. Keep agreed repair and disclosure decisions in their shared conversation so absent participants and later reviewers can follow them.
