What is the key benefit of using a GitHub security advisory within a repository?

Question

Options

• AIt automatically reverts commits that introduced the vulnerability.
• BIt allows maintainers to privately disclose, discuss, and publish vulnerabilities.
• CIt flags all forks of the repository as vulnerable.
• DIt prevents users from cloning the repository until issues are resolved.

• A
  2% (1)
• B
  91% (39)
• C
  5% (2)
• D
  2% (1)

Explanation

GitHub security advisories give repository maintainers a private, controlled workflow for handling vulnerabilities: they can draft the advisory in a temporary private fork, collaborate with reporters and team members confidentially, then publish a coordinated disclosure once a fix is ready - all without alerting attackers prematurely.

Why the distractors are wrong:

• A - GitHub has no mechanism to auto-revert commits; that would require understanding code semantics beyond what the platform does.
• C - Advisories do not propagate vulnerability flags to forks; forks are independent repositories.
• D - GitHub never blocks cloning as a security enforcement measure; that would break legitimate access.

Memory tip: Think of a security advisory as a "private meeting room" - you invite only trusted people, hammer out a fix, and only then open the door to announce it publicly. The key word is private coordination before public disclosure.

No community discussion yet for this question.