(3398) Consider enabling GitHub Private Vulnerability Reporting (PVR)

[daniel-msft]

Hi,

I recently identified a security issue in jsdiff and wanted to report it through GitHub's Private Vulnerability Reporting feature, but it's not currently enabled on this repository.

I've reached out via email with the details (found via your public npm maintainer profile), but for future reports — from me or anyone else — PVR provides a secure, structured channel that:

• Keeps vulnerability details private until a fix is ready
• Lets you coordinate disclosure timelines with reporters
• Automatically generates GitHub Security Advisories (GHSAs) and CVEs when you're ready to publish

You can enable it in Settings → Code security → Private vulnerability reporting. More info: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

Given jsdiff's download count (~397M/month) and dependent package count (4,153+), having a clear security reporting channel would benefit the entire ecosystem.

Thank you, truly, for maintaining this library!

Best,
Daniel Cervera

[ExplodingCabbage]

I've reached out via email with the details (found via your public npm maintainer profile)

I don't see the email - I guess you emailed only Kevin? (I notice I ought to add myself to the "bugs" field in package.json, or else change it to point only to GitHub issues.)

@kpdecker as repo owner you're the only one who can enable PVR. I've never touched it so at some point I'll have a play with it in a toy repo with some sockpuppet accounts and see if I think we should enable it.

It seems like it would be nice if we could enable it even if purely to reduce friction for researchers who are used to reporting things that way, but I suspect that, like with GitHub's security advisories, with mere maintainer permissions I won't actually have the ability to do the stuff I need to in PVR, so we'd need to either leave it switched off, transfer ownership to me, have me nag Kevin every time I want a PVR-related action performed, or possibly create a team to own the repo (I think this is the way to give multiple users "owner" permission?).

(I am not too fussed about this because I expect all security-relevant bugs with jsdiff to be denial of service issues caused by accidental high-time-complexity code paths, and personally, I think it's absolutely fine to report those publicly; there is simply no straightforward path by which a bad actor can go from reading such a report to finding a worthwhile way to weaponise it.)