Repository security advisories: say which published advisories reach the GitHub Advisory Database, and how long it can take #46612

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/about-repository-security-advisories (section "Dependabot alerts for published security advisories")

What part(s) of the article would you like to see updated?

That section says GitHub "will review each published security advisory, add it to the GitHub Advisory Database", and that "This process can take up to 72 hours". Maintainers read this as: every published advisory reaches the global database within about three days. That is not what they see, and the article doesn't help them tell a delay from an exclusion.

• Scope: "About the GitHub Advisory Database" says "We review advisories if they are for a vulnerability in a package that comes from a supported registry", and GitHub staff wrote in Adding GHSA from non ecosystem software advisory-database#7268 that repository advisories need "a curation step before they appear in the global database". So an advisory without a package in a supported ecosystem stays on the repository. For example, the three published advisories of mcu-tools/mcuboot still return 404 from GET /advisories/{ghsa_id}.
• Timing: advisories that do name a package can take far longer than 72 hours. GHSA-44f3-xgp9-pvp2 (npm hackmyagent, published 2026-08-09) and GHSA-2mh4-2jfx-3h7r (npm @wbce-d9/api, published 2026-10-12) both return 404. Their maintainers opened Eight published repository advisories not appearing in the global Advisory Database advisory-database#10342 (eight advisories) and Multiple published repository advisories not appearing in the Advisory Database after 5–16 days advisory-database#10746 (21 advisories) to ask whether something is missing on their side, and GHSA-wqvf-7262-m7g8 is missing in GitHub Advisory Database advisory-database#10688 asks the same about another advisory.

Suggested update (the exact wording is yours):

1. Say that only advisories that name a package in a supported ecosystem are considered for the GitHub Advisory Database, and that other advisories stay on the repository, so Dependabot and other tools that use the database don't alert on them.
2. Give a realistic time frame for review, or say that 72 hours is not guaranteed, and tell maintainers how to check (GET /advisories/{ghsa_id} returns 404 until the advisory is added) and where to ask if it hasn't appeared.

Expected outcome: maintainers know whether, and roughly when, to expect their advisory in the database, and when to follow up.

Additional information

Every status above was checked on 2026-10-30 with two unauthenticated REST calls: GET /repos/{owner}/{repo}/security-advisories?state=published lists a repository's published advisories, and GET /advisories/{ghsa_id} returns 404 for each one that is not in the global database.

On a larger scale, Safeguard reported on 2026-10-18 that 764 of 2,486 repository advisories published in 2026 by 45 projects (30.7%) were not in the reviewed database or OSV, and that those that did arrive took a median of 5.4 days: https://safeguard.sh/resources/blog/github-repository-advisories-missing-from-advisory-database-2026-data . MV2's open census of self-hosted applications found a similar gap: https://github.com/munimtechnologies/advisory-import-census

Disclosure: this issue was prepared with AI agents working for MV2 of Munim, Inc.

MV2, Munim, Inc. (mv2@munimtech.com)