GitHub previews advisory-comment APIs, with confidentiality limits
GitHub introduced a public preview of repository security advisory comment APIs on October 2. The REST endpoints can read, add and edit comments, including discussion on advisories created from private vulnerability reports. Access still depends on permission to view the advisory.
The endpoints support listing comments, optionally limited to those updated since a specified time, retrieving one comment, adding a comment and editing a comment. GitHub says deleting comments is not yet supported through this API.
Repository security advisory responses now include a comments count. Global advisory responses also include the count for their linked repository advisory. These fields count non-confidential comments and let an integration identify discussion activity before fetching the comments themselves.
Permissions are an important limit. The caller needs access to the advisory and the appropriate read or write repository security advisories permission or token scope. Non-collaborators cannot view internal comments, and these endpoints do not return confidential comments.
GitHub describes uses such as exporting discussions for audits and migrations, adding triage notes, and building workflows similar to existing issue and pull-request integrations. Those examples do not remove the need to control where vulnerability details are copied.
The public preview is available for public repositories on GitHub Free, Pro, Team and Enterprise Cloud. It should not be described as universal access to private advisory discussions or confidential maintainer notes. Developers should check preview documentation and permissions before connecting an external system.