私密漏洞报告新增速率限制

开源项目维护者收到的低质量和自动化漏洞报告越来越多，这可能会淹没真正重要的报告。速率限制会限制单个账户每天可向你的仓库以及整个 GitHub 提交的新报告数量。这有助于保护你免受批量和自动化提交的影响，同时合法的安全研究人员仍可联系到你。

本次更新包括：

• 私密漏洞报告现在会对每位用户提交的新报告实施每日速率限制。
• 达到限制的报告者会看到提示其稍后再试的消息。
• 限制仅适用于新报告，不影响现有安全公告上的评论。
• 仓库管理员可以为其仓库设置自定义的每日报告总量限制。
• 仓库管理员可以将可信报告者添加到允许列表，使其永远不会受到速率限制。

要配置这些设置，请前往仓库的设置页面，选择 Advanced Security，然后点击“Private vulnerability reporting”旁的 Settings。

该功能适用于已启用私密漏洞报告的公开仓库，覆盖 GitHub Free、GitHub Pro、GitHub Team 和 GitHub Enterprise Cloud。

请参阅有关配置私密漏洞报告的文档了解更多信息。

Open source maintainers are receiving more low-quality and automated vulnerability reports, which can bury the reports that matter. Rate limits cap how many new reports a single account can submit in a day, both to your repository and across GitHub. This helps protect you from bulk and automated submissions, while legitimate researchers can still reach you.

With this update:

• Private vulnerability reporting now applies daily per-user rate limits to new reports.
• Reporters who reach a limit see a message asking them to try again later.
• Limits apply only to new reports. Comments on existing advisories aren’t affected.
• Repository administrators can set a custom daily overall reporting limit for their repository.
• Repository administrators can add trusted reporters to an allow list so they’re never rate limited.

To configure these settings, go to your repository’s settings, select Advanced Security , and click Settings next to “Private vulnerability reporting.”

This is available for public repositories with private vulnerability reporting enabled on GitHub Free, GitHub Pro, GitHub Team, and GitHub Enterprise Cloud.

Learn more in our docs about configuring private vulnerability reporting.