GitHub Confidential Comment Access
On 2 October 2026, GitHub added confidential comments to repository security advisories. Repository writers can read them; reporters and invited collaborators without write access cannot and receive no notifications.
Visibility ends with write access. Posted comments cannot change visibility; views are logged.
Check audience and archives
Review writers before sensitive notes; use a narrower channel when needed.
Public GraphQL and REST omit these comments. Check API archives for missing context.
Available for public repositories with private vulnerability reporting enabled: GitHub Free, Pro, Team and Enterprise Cloud.
Keep shared decisions usable
GitHub’s advisory workflow gives maintainers and reporters a place to discuss impact, coordinate a fix and prepare disclosure.
Keep repair and disclosure decisions shared, so reporters and later reviewers can follow them.
