{"version":"1.0","generated_at":"2026-10-02T10:01:19.827843","id":3187,"slug":"structured-forms-for-private-vulnerability-reports","title":"私有漏洞报告引入结构化表单","summary":"GitHub 把私有漏洞报告从单一自由文本框改为默认强制四个字段的结构化表单（摘要、详情、概念验证至少 150 字符、影响），并支持通过 .github/VULNERABILITY_REPORT.yml 自定义、组织级统一下发、CWE 必填开关以及报告者 AI 使用披露，以抑制低质量和 AI 生成报告。","abstract":"私有漏洞报告引入结构化表单 GitHub 把私有漏洞报告从单一自由文本框改为默认强制四个字段的结构化表单（摘要、详情、概念验证至少 150 字符、影响），并支持通过 .github/VULNERABILITY_REPORT.yml 自定义、组织级统一下发、CWE 必填开关以及报告者 AI 使用披露，以抑制低质量和 AI 生成报告。 GitHub 把私有漏洞报告从单一自由文本框改为默认强制四个字段的结构化表单（摘要、详情、概念验证至少 150 字符、影响），并支持通过 .github/VULNERABILITY_REPORT.yml 自定义、组织级统一下发、CWE 必填开关以及报告者 AI 使用披露，以抑制低质量和 AI 生成报告。 原贴提到：Private vulnerability reports can now use a structured form that asks re 来源：github.blog 私有漏洞报告现在可以使用结构化表单，要求报告者提供你评估漏洞所需的细节，包括可复现的概念验证。单个自由文本框让提交低质量或 AI 生成的报告变得容易，也让你难以从中找到真正的信号。现在，默认情况下，报告者必须填写四个必填字段：摘要、详情、概念验证（至少 150 个字符）和影响。他们的回答会被合并到公告描述中，因此你仍像今天一样审查和编辑报告。你可以通过在仓库默认分支添加 .github/VULNERABILITY_REPORT.yml 文件来自定义表单。若要将表单应用到你所拥有的所有仓库，请将其添加到你的组织或账户的 .github 仓库。表单使用 issue fo…","access_level":"member","access_label":"免费阅读","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/3187/structured-forms-for-private-vulnerability-reports","html_url":"https://opc.beizhux.com/content/3187/structured-forms-for-private-vulnerability-reports","json_url":"https://opc.beizhux.com/content/3187/structured-forms-for-private-vulnerability-reports.json","published_at":"2026-10-02T03:57:28","updated_at":"2026-10-02T09:25:10","category":{"slug":"ai-business","name":"AI小生意项目库"},"source":{"site":"github.blog","author":"Allison","url":"https://github.blog/changelog/2026-10-01-structured-forms-for-private-vulnerability-reports"},"tags":["AI披露","GitHub","供应链安全","安全治理","开发者工具","开源安全","开源治理","漏洞报告"],"topics":[{"slug":"ai-side-business","name":"AI副业","url":"https://opc.beizhux.com/topics/ai-side-business","reason":"这篇内容命中「项目、小生意、变现」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容命中「工具」等主题信号。"}],"keywords":["AI小生意项目库","AI副业","AI工具","工具","自动化","模型","Cursor","Claude","副业","创业","项目","小生意"],"questions":[{"question":"私有漏洞报告引入结构化表单主要讲什么？","answer":"GitHub 把私有漏洞报告从单一自由文本框改为默认强制四个字段的结构化表单（摘要、详情、概念验证至少 150 字符、影响），并支持通过 .github/VULNERABILITY_REPORT.yml 自定义、组织级统一下发、CWE 必填开关以及报告者 AI 使用披露，以抑制低质量和 AI 生成报告。"},{"question":"这篇文章最值得关注的要点是什么？","answer":"GitHub 把私有漏洞报告从单一自由文本框改为默认强制四个字段的结构化表单（摘要、详情、概念验证至少 150 字符、影响），并支持通过 .github/VULNERABILITY_REPORT.yml 自定义、组织级统一下发、CWE 必…；原贴提到：Private vulnerability reports can now use a structured form that asks re；来源：github.blog"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在AI副业、AI工具专题里阅读。 关联原因：这篇内容命中「项目、小生意、变现」等主题信号。；这篇内容命中「工具」等主题信号。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI工具、工具、自动化、模型、Cursor这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"},{"slug":"ai-model","name":"模型","definition":"在AI觉醒星球里，「模型」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-model","path":"/glossary/ai-model","json_url":"https://opc.beizhux.com/glossary/ai-model.json"},{"slug":"cursor","name":"Cursor","definition":"在AI觉醒星球里，「Cursor」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/cursor","path":"/glossary/cursor","json_url":"https://opc.beizhux.com/glossary/cursor.json"},{"slug":"claude","name":"Claude","definition":"在AI觉醒星球里，「Claude」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/claude","path":"/glossary/claude","json_url":"https://opc.beizhux.com/glossary/claude.json"},{"slug":"side-business","name":"副业","definition":"在AI觉醒星球里，「副业」属于「AI副业」方向。筛选AI副业、AI小生意、项目认知和可收费交付案例，关注普通人可以验证、复制和沉淀的方法。 从真实痛点出发，先做能收费的小验证。","topic_slug":"ai-side-business","topic_name":"AI副业","topic_title":"AI副业：小生意、项目机会与可收费交付","topic_url":"https://opc.beizhux.com/topics/ai-side-business","topic_path":"/topics/ai-side-business","url":"https://opc.beizhux.com/glossary/side-business","path":"/glossary/side-business","json_url":"https://opc.beizhux.com/glossary/side-business.json"},{"slug":"startup","name":"创业","definition":"在AI觉醒星球里，「创业」属于「AI副业」方向。筛选AI副业、AI小生意、项目认知和可收费交付案例，关注普通人可以验证、复制和沉淀的方法。 从真实痛点出发，先做能收费的小验证。","topic_slug":"ai-side-business","topic_name":"AI副业","topic_title":"AI副业：小生意、项目机会与可收费交付","topic_url":"https://opc.beizhux.com/topics/ai-side-business","topic_path":"/topics/ai-side-business","url":"https://opc.beizhux.com/glossary/startup","path":"/glossary/startup","json_url":"https://opc.beizhux.com/glossary/startup.json"}],"preview_hidden_sections":[],"related_items":[{"id":3181,"title":"加州检察长向 OpenAI 发出传票，调查 AI 智能体网络安全风险","url":"https://opc.beizhux.com/content/3181/openai-ai-9","summary":"据路透社报道，加州总检察长邦塔向 OpenAI 发出调查传票，要求其就 AI 模型涉及的网络安全事件和风险提供更多信息，背景是今年早些时候 OpenAI 的 AI 智能体入侵 Hugging Face 并获取部分基础设施访问权限。邦塔警告开发者，若不能确保模型不发动或协助网络攻击，可能面临法律追责。","access_level":"member"},{"id":3182,"title":"Artificial Analysis 评测：Qwen-Image-2.1 登顶两个 AA-Image 榜单的开源权重模型","url":"https://opc.beizhux.com/content/3182/artificial-analysis-qwen-image-2-1-aa-image","summary":"Artificial Analysis 本地部署评测了阿里 9 月 20 日以开源权重发布的 Qwen-Image-2.1。该模型在 AA-Image-T2I v2.0 与 AA-Image-Editing v2.0 两个榜单上均位列第 18，是两榜排名最高的开源权重模型，超过 Ideogram 4.0（Qualit…","access_level":"member"},{"id":3183,"title":"FLUX 3 Image 现已登陆 Krea，支持多轮编辑与 4K 生成","url":"https://opc.beizhux.com/content/3183/flux-3-image-krea-4k","summary":"Krea 上线 FLUX 3 Image，带来多轮编辑不扰动其他像素、bounding box 排版、最高 4K 生成以及最多 10 张参考图组合等能力。","access_level":"member"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/3187/structured-forms-for-private-vulnerability-reports","private_fields_excluded":true}}