Subscribing to security advisory notifications

[Yoyoda75]

Select Topic Area

Question

Body

Hi everyone, I would like to subscribe to security advisory notifications, let's say from this repository. I have checked the Security alerts box in Watch/custom but I'm not receiving any notification when an adivsory is published.

My question is: does security alert correspond to security advisories or is it a different section ?

Thank you

[JajarGaming]

When you check the box to enable Security alerts for a repository, you should receive notifications whenever a new security advisory is published for that repository.

However, there are a few things you may want to check to ensure that you are properly set up to receive these notifications:

1. Make sure you are watching the repository: You mentioned that you checked the "Watch" option, but it's possible that you may not be watching the repository for which you want to receive security advisories. To check this, go to the repository page, click the "Watch" button, and make sure "Watching" is selected.

2. Check your notification settings: Even if you have enabled Security alerts and are watching the repository, you may not be receiving notifications if your notification settings are not configured correctly. To check your notification settings, click on your profile picture in the top right corner of the GitHub page, then click "Settings". From there, click "Notifications" and make sure that you have enabled email or web notifications for security advisories.

3. Verify that there are security advisories for the repository: It's possible that the repository you are watching may not have any published security advisories yet. To check this, go to the "Security" tab of the repository and see if any advisories are listed.

[likeshumidity]

re: '... click "Notifications" and make sure that you have enabled email or web notifications for security advisories.'

There appears to be nothing related to security advisories for a repo only security advisories for dependencies. It would be super helpful if this included Security Advisories for the repo itself.

[JajarGaming]

I'm confused what you mean by repository security advisories. Security advisories are related to the dependencies inside the repository

[likeshumidity]

Repo A

• Security Advisories
  • Security Advisory 1
• Dependencies
  • Repo B

Repo B

• Security Advisories
  • Security Advisory 2

If I subscribe to security notifications for Repo A, I would get notified about Security Advisory 2, because Repo B is a dependency of Repo A, but I would not get notified about Security Advisory 1.

I want to be notified about Security Advisory 1 and 2 if I am subscribed to security notifications for Repo A.

Does that clarify?

[JajarGaming]

Yes, not sure if that's changeable

[ningziwen]

+1 Suggest supporting notifying the security advisory of current repo. ("security advisory 1" in the response above)

[t80027t]

Same problem for me - i'm not getting email notifications on newly published Security Advisories when i am watching for 'Security Alerts' only. I've tripled checked all settings.

If i change Watch settings on the repo from 'Custom' on Security Alerts to 'All Activity', then i get emails on newly published Security Advisories (but i don't want emails on everything else!)

[linwalth]

Our team wanted to get notified only when a security advisory was published on a repository we are watching.

It would be really useful if this actually worked, especially since the state of it not working is rather unintuitive.

Being able to customize when to get notifications and then not actually getting notified was confusing to our team. As I am sure it was - and is - to others.

We would appreciate this be fixed 🙂