Privately report a security vulnerability

2 parameters · 7 body fields

ownerstringrequired

The account owner of the repository. The name is not case sensitive.

repostringrequired

The name of the repository without the `.git` extension. The name is not case sensitive.

summarystringrequired

A short summary of the advisory.

descriptionstringrequired

A detailed description of what the advisory impacts.

vulnerabilitiesarray<object>optional

An array of products affected by the vulnerability detailed in a repository security advisory.

cwe_idsarray<string>optional

A list of Common Weakness Enumeration (CWE) IDs.

severitystringoptional

The severity of the advisory. You must choose between setting this field or `cvss_vector_string`.

Allowed:criticalhighmediumlow

cvss_vector_stringstringoptional

The CVSS vector that calculates the severity of the advisory. You must choose between setting this field or `severity`.

start_private_forkbooleanoptional

Whether to create a temporary private fork of the repository to collaborate on a fix.

Default:false

4 status codes

201Response

ghsa_idstringrequired

The GitHub Security Advisory ID.

cve_idstringrequired

The Common Vulnerabilities and Exposures (CVE) ID.

urlstringrequired

The API URL for the advisory.

html_urlstringrequired

The URL for the advisory.

summarystringrequired

A short summary of the advisory.

descriptionstringrequired

A detailed description of what the advisory entails.

severitystringrequired

The severity of the advisory.

Allowed:criticalhighmediumlow

authorobjectrequired

The author of the advisory.

publisherobjectrequired

The publisher of the advisory.

identifiersarray<object>required

statestringrequired

The state of the advisory.

Allowed:publishedclosedwithdrawndrafttriage

created_atstringrequired

The date and time of when the advisory was created, in ISO 8601 format.

updated_atstringrequired

The date and time of when the advisory was last updated, in ISO 8601 format.

published_atstringrequired

The date and time of when the advisory was published, in ISO 8601 format.

closed_atstringrequired

The date and time of when the advisory was closed, in ISO 8601 format.

withdrawn_atstringrequired

The date and time of when the advisory was withdrawn, in ISO 8601 format.

submissionobjectrequired

vulnerabilitiesarray<object>required

cvssobjectrequired

cvss_severitiesobjectoptional

cwesarray<object>required

cwe_idsarray<string>required

A list of only the CWE IDs.

creditsarray<object>required

credits_detailedarray<object>required

collaborating_usersarray<SimpleUser>required

A list of users that collaborate on the advisory.

collaborating_teamsarray<Team>required

A list of teams that collaborate on the advisory.

private_forkobjectrequired

A temporary private fork of the advisory's repository for collaborating on a fix.

403Forbidden

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

404Resource not found

messagestringoptional

documentation_urlstringoptional

urlstringoptional

statusstringoptional

422Validation failed.

2 documented failures

missing_sectiondescription
unchecked_required_optiondescription

messagestringrequired

documentation_urlstringrequired

errorsarray<object>optional

Error handling

A 403 is returned: Forbidden. A 404 is returned: Resource not found. A 422 is returned: Validation failed.

import { Client } from "octri-github";

const client = new Client({
  baseUrl: "https://api.github.com",
  auth: { bearer: process.env.API_TOKEN },
  retry: {
    maxAttempts: 3,
    retryOn: [
      408,
      425,
      429,
      500,
      502,
      503,
      504,
    ],
    backoffMs: 500,
    maxBackoffMs: 8000,
  },
  timeoutMs: 30000,
});

const result = await client.reports.create({
  owner: "octocat",
  repo: "hello-world",
  summary: "example",
  description: "Lorem ipsum",
  vulnerabilities: [],
});

{
  "ghsa_id": "GHSA-abcd-1234-efgh",
  "cve_id": "CVE-2050-00000",
  "url": "https://api.github.com/repos/repo/a-package/security-advisories/GHSA-abcd-1234-efgh",
  "html_url": "https://github.com/repo/a-package/security/advisories/GHSA-abcd-1234-efgh",
  "summary": "A newly discovered vulnerability",
  "description": "A more in-depth description of what the problem is.",
  "severity": "high",
  "author": {
    "login": "octocat",
    "id": 1,
    "node_id": "MDQ6VXNlcjE=",
    "avatar_url": "https://github.com/images/error/octocat_happy.gif",
    "gravatar_id": "",
    "url": "https://api.github.com/users/octocat",
    "html_url": "https://github.com/octocat",
    "followers_url": "https://api.github.com/users/octocat/followers",
    "following_url": "https://api.github.com/users/octocat/following{/other_user}",
    "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
    "organizations_url": "https://api.github.com/users/octocat/orgs",
    "repos_url": "https://api.github.com/users/octocat/repos",
    "events_url": "https://api.github.com/users/octocat/events{/privacy}",
    "received_events_url": "https://api.github.com/users/octocat/received_events",
    "type": "User",
    "site_admin": false
  },
  "publisher": null,
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-abcd-1234-efgh"
    },
    {
      "type": "CVE",
      "value": null
    }
  ],
  "state": "triage",
  "created_at": "2020-01-01T00:00:00Z",
  "updated_at": "2020-01-02T00:00:00Z",
  "published_at": null,
  "closed_at": null,
  "withdrawn_at": null,
  "submission": {
    "accepted": false
  },
  "vulnerabilities": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "a-package"
      },
      "vulnerable_version_range": "< 1.0.0",
      "patched_versions": "1.0.0",
      "vulnerable_functions": [
        "important_function"
      ]
    }
  ],
  "cvss": null,
  "cvss_severities": {
    "cvss_v3": null,
    "cvss_v4": null
  },
  "cwes": [
    {
      "cwe_id": "CWE-123",
      "name": "A CWE"
    }
  ],
  "cwe_ids": [
    "CWE-123"
  ],
  "credits": [
    {
      "login": "octocat",
      "type": "finder"
    }
  ],
  "credits_detailed": [
    {
      "user": {
        "login": "octocat",
        "id": 1,
        "node_id": "MDQ6VXNlcjE=",
        "avatar_url": "https://github.com/images/error/octocat_happy.gif",
        "gravatar_id": "",
        "url": "https://api.github.com/users/octocat",
        "html_url": "https://github.com/octocat",
        "followers_url": "https://api.github.com/users/octocat/followers",
        "following_url": "https://api.github.com/users/octocat/following{/other_user}",
        "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
        "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
        "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
        "organizations_url": "https://api.github.com/users/octocat/orgs",
        "repos_url": "https://api.github.com/users/octocat/repos",
        "events_url": "https://api.github.com/users/octocat/events{/privacy}",
        "received_events_url": "https://api.github.com/users/octocat/received_events",
        "type": "User",
        "site_admin": false
      },
      "type": "finder",
      "state": "accepted"
    }
  ],
  "collaborating_users": [
    {
      "login": "octocat",
      "id": 1,
      "node_id": "MDQ6VXNlcjE=",
      "avatar_url": "https://github.com/images/error/octocat_happy.gif",
      "gravatar_id": "",
      "url": "https://api.github.com/users/octocat",
      "html_url": "https://github.com/octocat",
      "followers_url": "https://api.github.com/users/octocat/followers",
      "following_url": "https://api.github.com/users/octocat/following{/other_user}",
      "gists_url": "https://api.github.com/users/octocat/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/octocat/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/octocat/subscriptions",
      "organizations_url": "https://api.github.com/users/octocat/orgs",
      "repos_url": "https://api.github.com/users/octocat/repos",
      "events_url": "https://api.github.com/users/octocat/events{/privacy}",
      "received_events_url": "https://api.github.com/users/octocat/received_events",
      "type": "User",
      "site_admin": false
    }
  ],
  "collaborating_teams": [
    {
      "name": "Justice League",
      "id": 1,
      "node_id": "MDQ6VGVhbTE=",
      "slug": "justice-league",
      "description": "A great team.",
      "privacy": "closed",
      "notification_setting": "notifications_enabled",
      "url": "https://api.github.com/teams/1",
      "html_url": "https://github.com/orgs/github/teams/justice-league",
      "members_url": "https://api.github.com/teams/1/members{/member}",
      "repositories_url": "https://api.github.com/teams/1/repos",
      "permission": "admin",
      "parent": null
    }
  ],
  "private_fork": null
}

Was this helpful?

Request

Response

Errors