From b8672b6f0a93641d94ce66cd39a9725e71c6e04e Mon Sep 17 00:00:00 2001 From: ChethanUK Date: Tue, 21 Jul 2026 16:18:18 +0200 Subject: [PATCH] chore: route security reports to private advisories SECURITY.md:16 directs reporters to GitHub Private Vulnerability Reporting, but the issue chooser had no route to it. With blank_issues_enabled: false, someone holding a credential-leak bug lands on the public Bug Report form. Add the advisory link as the FIRST contact_link. Ordering is the substance here: the chooser is three rows, and a reporter should not have to read past two Discussions links to find the private channel. Verified private vulnerability reporting is enabled on the repo (GET /repos/alibaba/open-code-review/private-vulnerability-reporting returns {"enabled":true}), so the link resolves to a live form. --- .github/ISSUE_TEMPLATE/config.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 0785ee8e..3de94386 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,5 +1,8 @@ blank_issues_enabled: false contact_links: + - name: "\U0001F512 Report a Security Vulnerability" + url: https://github.com/alibaba/open-code-review/security/advisories/new + about: Please report vulnerabilities privately, not as public issues. See SECURITY.md. - name: "\U0001F4AC Questions & Help" url: https://github.com/alibaba/open-code-review/discussions/categories/q-a about: Ask questions or get help with configuration in Discussions.