A maintainer’s guide to vulnerability disclosure: GitHub tools to make it simple

The document outlines a step-by-step approach for open source maintainers to responsibly manage vulnerability disclosures using GitHub tools, including enabling Private Vulnerability Reporting, collaborating on fixes via draft security advisories, requesting CVE identifiers, publishing advisories, and notifying users through channels like Dependabot. It emphasizes coordinated vulnerability disclosure, setting expectations with SECURITY.md, prioritizing and assessing severity (e.g., CVSS), and ensuring transparent, actionable advisories to protect users while minimizing exposure prior to patch release.