So you got your first GHSA. Don't panic.
A practical, consult-as-you-go guide for open source maintainers handling GitHub security advisories: triage, private forks, CVEs, publication, and the gotchas nobody warns you about.
Important
Draft under review before the first release. Corrections and feedback are welcome.
The guide is published as a Docusaurus site at https://alpha-omega-security.github.io/maintainers-security-advisory-guide/.
The Markdown source lives in docs/, which also renders directly on GitHub:
- Start here · Cheatsheet · FAQ · Limitations · Resources
npm install
npm start # local dev server with hot reload
npm run build # static build in ./buildDeploys to GitHub Pages via .github/workflows/deploy-docs.yml (manual trigger for now).
This begins as an opinionated guide by Ulises Gascón, based on personal experience, and opens to community consensus over time. See CONTRIBUTING.md.
CC BY 4.0. Code snippets are free to use without attribution.