Kit vs GitHub private vulnerability reporting: your repos, or your company.
A researcher who finds a bug in your public repo is already on the page with GitHub's Report a vulnerability button, and the fix can end with a free CVE in about 72 hours — Kit cannot issue a CVE at all. Kit answers the auditor asking about everything else, the hosted product, the domains, the acknowledgment record. The honest recommendation is to run both.
Who should choose what?
Choose Kit if you're:
- Proving a process to an auditor — Kit brings zero researchers and will find nothing for you
- Running a closed-source product the repo button cannot cover
- Taking reports from people with no GitHub account, or no name
- Needing an acknowledgment clock with a breach record behind it
- Collecting W-9/W-8BEN forms and keeping a bounty ledger (payouts stay manual)
Choose GitHub private vulnerability reporting if you're:
- An open source maintainer, or a company whose product is a public repo
- Counting on a free CVE as the deliverable of disclosure
- Wanting the reporter in the patch, via a temporary private fork
- Publishing advisories that alert downstream dependents
- Working the advisory queue over a REST API
- Spending $0 and one toggle per repository
What makes GitHub private vulnerability reporting special
Three things Kit does not compete with: a CNA, a patch workspace, and ambient researchers.
Free CVEs from a real CNA
GitHub is a CVE Numbering Authority. An advisory admin clicks Request CVE, GitHub usually reviews it within 72 hours, and the ID stays private until you publish. GitHub did say in June 2026 that Advisory Database publication has run behind its internal goals since mid-April.
Why this matters: A CVE is what makes downstream scanners and enterprise customers act. Kit cannot issue one at all.
Disclosure inside the repository
The reporter is added as a collaborator on the advisory, a temporary private fork hosts the patch, and publishing pushes the GHSA into the Advisory Database — which fires Dependabot alerts for every project that depends on you.
Why this matters: Alerting every downstream dependent is the most consequential act in a disclosure, and no standalone VDP tool can do it.
Researchers are already there
GitHub reports more than 1.7 million repositories with the feature enabled, and its own telemetry shows private reports climbing from about 550 a week in January 2026 to over 3,000 a week by May.
Why this matters: Nobody has to find your portal. The researcher reading your code is one click from the report form.
What Kit does well
Four things Kit covers that a repository button cannot, starting with the person who has no login.
Covers the company, not the repo
GitHub's own eligibility line is "available for public repositories on GitHub.com" — a closed-source product, an API, a mobile app or a cloud account has no button, and GitHub Enterprise Server has none either. Kit's intake form takes a report about any of them.
The auditor's question is about the company, and most of your attack surface is not a public repository.
Anonymous reports, accepted
GitHub's report form redirects a signed-out visitor to the login page; every report is tied to a GitHub account. Kit's intake leaves the email field optional and hands the reporter a durable receipt link either way.
The reporter who declines to identify themselves is often the one you most need to hear from.
A 72-hour acknowledgment clock
GitHub's disclosure guidance tells maintainers to acknowledge "as quickly as possible" — advice, with no timer in the product. Kit starts a 72-hour acknowledgment clock on every report, pages on-call when a report above informational runs at risk, and charts MTTA and MTTR.
When an auditor asks for your committed acknowledgment time and proof you met it, the answer is a number and a record.
security.txt, auto-published
Kit serves RFC 9116 security.txt at /.well-known/security.txt on your domain and watches its expiry with a 14-day warning. GitHub's guide to adding a security policy is a SECURITY.md file in the repo, and that page never mentions RFC 9116.
security.txt is the first place researchers and scanners look on a domain, and a repo file cannot be served at your apex.
What Kit doesn't have
Four things GitHub's button does that Kit does not, and what we plan to do about each one.
Researchers already there
GitHub reported in 2026 that more than 1.7 million repositories have private vulnerability reporting enabled; a researcher reading your code is already on the page with the button. A Kit portal has no ambient traffic — discovery rides on your security.txt and wherever you place the form.
Will we add this? No. Kit brings no researchers and never will. If the goal is to be found, enable GitHub's button today.
No CVE issuance
GitHub is a CVE Numbering Authority and usually reviews a CVE request within 72 hours, free, without publishing anything. Kit tracks the report, not the identifier — it cannot issue or reserve a CVE.
Will we add this? No. Becoming a CNA is not on any roadmap. Publish the advisory on GitHub; track the intake and the clock in Kit.
No patch workspace
GitHub opens a temporary private fork where reporter and maintainer patch together, and publishing fires Dependabot alerts at every downstream dependent. Kit's triage board is a separate system from your code: no fork, no merge, no fan-out.
Will we add this? No. The patch belongs where the code lives. Kit syncs a report to Jira or Linear instead of hosting the fix.
No REST API
GitHub documents eight REST endpoints for repository advisories. Kit ships MCP tools and 11 webhook events, and no REST API.
Will we add this? Undecided. MCP and webhooks are the integration surface today, and we would rather deepen those than start a second one.
Philosophy differences
Two different jobs: GitHub closes the loop on a bug in your code, Kit proves your company handles whatever arrives.
prove you handled it
Kit assumes the question is an auditor's: prove there is a process. Intake is included with a $8-a-seat Kit subscription up to 25 reports a month; the triage board, acknowledgment clock, ledger, bounties and evidence exports are the $49-a-month add-on. If your goal is finding vulnerabilities rather than handling the ones that arrive, Kit is the wrong category.
the report lands where the fix lands
Free on every public repository, one toggle away. The report, the private patch fork, the CVE request and the published advisory all live where the fix has to land, and publishing alerts every downstream dependent. If your product is a public repo, GitHub wins outright and Kit is redundant.
Pricing reality check
Kit
$49/month
VDP add-on on top of a $8/seat/month Kit subscription; 30-day trial, no annual commitment.
- Intake included with a Kit seat, capped at 25 reports a month
- 72-hour acknowledgment clock, MTTA/MTTR dashboards
- Anonymous intake with a durable receipt link
- Append-only bounty ledger, W-9/W-8BEN collection
- Auto-published RFC 9116 security.txt
GitHub private vulnerability reporting
$0 on public repositories
Free on public repositories regardless of plan — the feature never appears in GitHub's paid-plan matrix at all.
- Free on public repositories, on any GitHub plan
- CVE requests reviewed free, usually within 72 hours (GitHub's own hedge)
- Temporary private fork for patching (CI cannot run inside it)
- Eight documented REST endpoints for advisories
- Publishing fires Dependabot alerts downstream
Pricing reality check
GitHub's feature is free, instant and ungated — nothing on this page argues otherwise. The comparison is scope: $49 a month on top of a $8 seat buys intake, clocks and evidence for everything that is not a public repository on GitHub.com.
Adding Kit next to GitHub?
You'll want Kit alongside if:
- An auditor asked about the hosted product, and the repo button cannot answer
- You need a committed acknowledgment time with a record you met it
- Reporters without GitHub accounts — or without names — should still get through
- You run GitHub Enterprise Server, where private reporting does not exist
- You want security.txt live at your apex before Friday
Stay with GitHub alone if:
- Your whole security surface is public repositories on GitHub.com
- A free CVE from a CNA is the artifact you need
- Reporters should help write the patch in a temporary private fork
- Publishing into Dependabot's alert feed is the point of disclosure
Data portability: GitHub advisories export over its REST API, and published GHSAs and CVEs are public records by construction. There is no import path into GitHub advisories, and no need for one: reports about your repos stay on GitHub, and Kit starts a record for everything else.
Keep GitHub for the code. Add Kit for the company.
The VDP add-on carries a 30-day trial and no annual commitment. Your repos keep their Report a vulnerability button either way.
$49€49159 zł£39 per month, on top of a Kit seat
Start free trial