---
title: "GitHub Structured forms for private vulnerability reports: 2026-10-01 | Harbyn"
description: "GitHub Structured forms for private vulnerability reports, announced Oct 1, 2026."
canonical: "https://harbyn.com/changes/github/2026-10-01-structured-forms-for-private-vulnerability-reports"
last-updated: 2026-10-02
---

# GitHub Structured forms for private vulnerability reports

Markdown version of <https://harbyn.com/changes/github/2026-10-01-structured-forms-for-private-vulnerability-reports>.

Behavior change - GitHub. low severity. In effect.

Private vulnerability reports now use a structured form (summary, details, a proof of concept of at least 150 characters, and impact), and maintainers can define a custom form in .github/VULNERABILITY\_REPORT.yml. With a custom form, reports created through the REST API must match it; the default form is not enforced for the API.

## Facts

| Fact | Value |
| --- | --- |
| Vendor | [GitHub](https://harbyn.com/vendors/github.md) |
| Kind | Behavior change |
| Severity | low |
| Status | In effect |
| Announced | Oct 1, 2026 |
| Added to Harbyn | Oct 2, 2026 |
| Lead time | No dated deadline |
| Vendor page | <https://github.blog/changelog/2026-10-01-structured-forms-for-private-vulnerability-reports> |
| Review | Reviewed by a person, extracted by a deterministic parser |

## Find it in your code

```sh
npx harbyn scan
```

This change names no identifier the scanner can match line by line, so the scan tells you whether your repository uses GitHub, from its packages and API hosts. Nothing leaves your machine.

## Sources

Where this event comes from: the page we read, when we read it, and the hash of that snapshot.

- <https://github.blog/changelog/feed/> (changelog, fetched 2026-10-02 01:24 UTC, sha256 `bd3af8219f8faeee6a202b99e6ef1e4a28e8f6eefd2ed6c5c13ce910603301e0`)

## Related changes

### More from GitHub

- [GitHub Actions: retention setting now deletes old checks, workflow runs and statuses](https://harbyn.com/changes/github/2026-10-01-actions-retention-now-covers-checks-runs-and-statuses.md) (Behavior change, announced Oct 1, 2026)
- [Code coverage uploads no longer fail CI for new branches](https://harbyn.com/changes/github/2026-10-01-code-coverage-uploads-no-longer-fail-ci-for-new-branches.md) (Behavior change, announced Oct 1, 2026)
- [GitHub Actions: macOS 14 runner image retired on November 2, 2026](https://harbyn.com/changes/github/2026-10-01-github-actions-macos-14-runner-image-retirement.md) (Retirement, effective Nov 2, 2026)
- [Scheduled code scanning skips inactive repositories](https://harbyn.com/changes/github/2026-10-01-scheduled-code-scanning-skips-inactive-repositories.md) (Behavior change, announced Oct 1, 2026)

### Changes at other vendors

- [Amazon Selling Partner API: ORDER\_CHANGE notifications add PreFulfillmentStatusChange for Amazon Autos](https://harbyn.com/changes/amazon-sp-api/2026-10-14-sp-api-updates-new-listings-items-api-ivp-values-in-eu5-jp-and-ca-stores-oct-3.md) (effective Oct 28, 2026)
- [BigCommerce: 301 redirects will apply only to storefront channels](https://harbyn.com/changes/bigcommerce/2026-10-07-301-redirects-now-apply-to-storefront-channels-only.md) (effective Nov 10, 2026)
- [Jira / Atlassian Cloud: New IP address ranges in use from January 1, 2027](https://harbyn.com/changes/atlassian-jira/2026-10-16-atlassian-cloud-adds-new-ip-address-ranges.md) (effective Jan 1, 2027)
- [Let's Encrypt: Default certificate lifetime changes to 64 days](https://harbyn.com/changes/letsencrypt/2026-10-07-64-day-certificate-lifetimes-coming-feb-2027.md) (effective Feb 10, 2027)

[All upcoming deadlines](https://harbyn.com/deadlines.md)