{"meta":{"title":"Collaborating in a temporary private fork to resolve a repository security vulnerability","intro":"You can create a temporary private fork to privately collaborate on fixing a security vulnerability in your public repository.","product":"Security and code quality","breadcrumbs":[{"href":"/en/code-security","title":"Security and code quality"},{"href":"/en/code-security/tutorials","title":"Tutorials"},{"href":"/en/code-security/tutorials/fix-reported-vulnerabilities","title":"Fix reported vulnerabilities"},{"href":"/en/code-security/tutorials/fix-reported-vulnerabilities/collaborate-in-a-fork","title":"Collaborate in a fork"}],"documentType":"article"},"body":"# Collaborating in a temporary private fork to resolve a repository security vulnerability\n\nYou can create a temporary private fork to privately collaborate on fixing a security vulnerability in your public repository.\n\n> \\[!NOTE]\n> This article applies to repository-level security advisories in a public repository.\n> To edit a global advisory in the GitHub Advisory Database, see [Editing security advisories in the GitHub Advisory Database](/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/edit-advisory-database).\n\n## Prerequisites\n\nBefore you can collaborate in a temporary private fork, you must create a draft security advisory. For more information, see [Creating a repository security advisory](/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/create-repository-advisory).\n\n## Creating a temporary private fork\n\nTo keep information about vulnerabilities secure, integrations, including CI, cannot access temporary private forks.\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n3. In the left sidebar, under \"Reporting\", click ** Advisories**.\n4. In the \"Security Advisories\" list, click the name of the security advisory you'd like to create a temporary private fork in.\n5. Scroll to the bottom of the advisory form and click **Start a temporary private fork**.\n\n \n\n A private fork of the repository is created and shown on the advisory page.\n\n The naming convention for the private fork is very similar to the convention used for advisories in the GitHub Advisory Database and follows this format: `repo-ghsa-xxxx-xxxx-xxxx`, where:\n\n * `repo` is the name of the repository. To stay under the 100 character limit on repository names, we truncate the original repository's name to 80 characters.\n * `xxxx-xxxx-xxxx` is the unique identifier of the draft security advisory:\n * `x` is a letter or a number from the following set: `23456789cfghjmpqrvwx`.\n * The numbers and letters are randomly assigned.\n * All letters and numbers are lowercase.\n\nFor example, if you create a temporary private fork in a repository called `octocat-repo`, and the automatically generated ID for the draft advisory is `GHSA-x854-cvjg-vx26`, the temporary fork will be called `octocat-repo-ghsa-x854-cvjg-vx26`.\n\nYou can also use the REST API to create temporary private forks. For more information, see [Create a temporary private fork](/en/rest/security-advisories/repository-advisories#create-a-temporary-private-fork) in the REST API documentation.\n\n## Adding collaborators to a temporary private fork\n\nAnyone with admin permissions to a security advisory can add additional collaborators to the security advisory, and collaborators on the security advisory can access the temporary private fork. For more information, see [Adding a collaborator to a repository security advisory](/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators).\n\n## Adding changes to a temporary private fork\n\nAnyone with write permissions to a security advisory can collaborate on a patch by committing changes to a temporary private fork.\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n3. In the left sidebar, under \"Reporting\", click ** Advisories**.\n4. In the \"Security Advisories\" list, click the name of the security advisory you'd like to work on.\n5. You can make your changes on GitHub or locally:\n\n * To make your changes on GitHub, under \"Collaborate on a patch\", click **the temporary private fork**. Then, create a new branch and edit files. For more information, see [Managing branches within your repository](/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-and-deleting-branches-within-your-repository) and [Editing files](/en/repositories/working-with-files/managing-files/editing-files).\n * To add changes locally, follow the instructions under \"Clone and create a new branch\" and \"Make your changes, then push.\"\n\n \n\n## Creating a pull request from a temporary private fork\n\nAnyone with write permissions to a security advisory can create a pull request from a temporary private fork.\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n3. In the left sidebar, under \"Reporting\", click ** Advisories**.\n4. In the \"Security Advisories\" list, click the name of the security advisory you'd like to create a pull request in.\n5. Scroll to the bottom of the advisory form. Then, under \"Collaborate on a patch\", click **Compare & pull request** to create a pull request for the associated branch.\n\n \n The \"Open a pull request\" includes a header showing the branches that will be compared in a three-dot Git diff comparison when the pull request is created. For more information, see [Branches](/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-comparing-branches-in-pull-requests#three-dot-and-two-dot-git-diff-comparisons).\n6. To create a pull request that is ready for review, click **Create Pull Request**.\n To create a draft pull request, use the drop-down and select **Create Draft Pull Request**, then click **Draft Pull Request**. If you are the member of an organization, you may need to request access to draft pull requests from an organization owner. See [Pull requests](/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-pull-requests#draft-pull-requests).\n\nYou cannot merge individual pull requests in a temporary private fork. Instead, you merge all open pull requests at once, in the corresponding security advisory. For more information, see [Merging changes in a security advisory](#merging-changes-in-a-security-advisory).\n\n## Merging changes in a security advisory\n\nAnyone with admin permissions to a security advisory can merge changes in a security advisory.\n\nYou cannot merge individual pull requests in a temporary private fork. Instead, you merge all open pull requests at once, in the corresponding security advisory.\n\nBefore you can merge changes in a security advisory, every open pull request in the temporary private fork must be mergeable. To keep information about vulnerabilities secure, status checks do not run on pull requests in temporary private forks. For more information, see [About protected branches](/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches).\n\nAdditionally, there can be no merge conflicts, and GitHub won't enforce any of the protection rules that you may have set up for the branch you're trying to merge the changes in to.\n\n1. On GitHub, navigate to the main page of the repository.\n2. Under the repository name, click the ** Security and quality** tab. If you cannot see the \" Security and quality\" tab, select the **** dropdown menu, and then click ** Security and quality**.\n3. In the left sidebar, under \"Reporting\", click ** Advisories**.\n4. In the \"Security Advisories\" list, click the name of the security advisory with changes that you'd like to merge.\n5. Scroll to the bottom of the advisory form. Then, under \"This advisory is ready to be merged\", click **Merge pull request(s)** to merge all open pull requests in the temporary private fork.\n\n\n\n> \\[!NOTE]\n> You can only merge one pull request into the `main` branch of a temporary private fork. If more than one pull request targets the `main` branch, merging is blocked.\n\nAfter you merge changes in a security advisory, you can publish the security advisory to alert your community about the security vulnerability in previous versions of your project. For more information, see [Publishing a repository security advisory](/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory).\n\n## Further reading\n\n* [Repository security advisories](/en/code-security/reference/permissions/repository-security-advisory)\n* [Publishing a repository security advisory](/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/publish-repository-advisory)"}