Rate limits for private vulnerability reports

Summary

GitHub added rate limits on private vulnerability reports to curb low-quality and automated submissions that bury legitimate reports for open source maintainers.

Key facts

• GitHub introduced rate limits for private vulnerability reports.
• Limits cap how many new reports a single account can submit.
• Maintainers face more low-quality and automated vulnerability reports.
• Change announced in GitHub Changelog on 2026-10-01.

Why it matters

Maintainers who triage vulnerability reports may see fewer junk submissions, making real security issues easier to find. Teams submitting reports should expect caps on how many they can file per account.