Block Spam on a GitHub Security Advisory

This guide shows you how to stop spam and abuse on a GitHub security advisory. You’ll learn how to lock down comments, report abuse, and manage notifications so your advisory stays focused on security, not noise. No special permissions are needed beyond write access to the repository where the advisory is published.

What You’ll Need

• Write or admin access to the repository where the advisory is published.
• A GitHub account (free or paid) to report abuse or manage settings.
• If the advisory is in a private repository, you must be a member of that repository.

Step-by-Step

1. Identify the spam or abuse. Open the advisory page (usually at https://github.com/[owner]/[repo]/security/advisories). Look for unwanted comments, off-topic posts, or links in the discussion section. Note the username and exact content.
2. Lock the conversation (if you are a maintainer). Scroll to the bottom of the advisory’s discussion thread. Click the Lock conversation button. Confirm by clicking Lock conversation on this issue. This immediately stops new comments from everyone except you and other maintainers with triage permission.
3. Delete individual spam comments. If you don’t want to lock the whole thread, hover over the spam comment, click the … (three dots) menu in the top-right corner, and select Edit or Delete. Deleting removes it permanently. For a less destructive option, you can edit the comment to remove the link or content.
4. Report abuse to GitHub. On the spam comment, click the … menu and choose Report content. Select a reason (e.g., “Spam” or “Abuse”) and submit. GitHub’s Trust & Safety team reviews these reports. This works even if you are not a maintainer.
5. Block the user (if you are an admin). Go to the user’s profile page, click the Block or Report button (looks like a person with a slash), then select Block user. This prevents them from commenting on any of your repositories, including the advisory. You can also block from the comment by clicking the username and using the same menu.
6. Restrict who can comment (for repository maintainers). In the repository settings, go to Moderation options and enable Interaction limits. Choose Limit to prior contributors or Limit to repository collaborators. This applies to all issues and discussions, including advisories. Note: this may be too broad if you want to keep the advisory open to the public.
7. Turn off notifications for the advisory. If the spam is flooding your inbox, click the Notifications button at the top of the advisory page and select Ignore. This stops all future notifications from that thread.
8. Update the advisory if needed. If the spam is in the description or metadata (e.g., a malicious link in the summary), click Edit at the top of the advisory, remove the offending content, and save.

Common Mistakes

• Locking the conversation too early. If you lock it before legitimate users have asked questions, you may miss important feedback. Only lock when spam is persistent or the discussion is no longer productive.
• Deleting comments without reporting. Deleting removes the content but doesn’t alert GitHub to the abuser. Always report the comment first so GitHub can take action against repeat offenders.
• Blocking the wrong user. Double-check the username before blocking. If you block a legitimate contributor by mistake, you’ll need to unblock them manually.
• Ignoring the interaction limits. Setting interaction limits to “prior contributors” can block new, legitimate users who want to report a vulnerability. Use this only if spam is overwhelming.
• Not checking the advisory’s “Draft” vs “Published” status. If the advisory is still a draft, only collaborators can see it, so spam is less likely. If published, it’s public and more exposed.

Tips

• Use the “minimize” option for less severe spam. Instead of deleting, you can minimize a comment to hide it behind a “Show minimized” link. This preserves the conversation history while reducing clutter.
• Set up auto-moderation for your repositories. In repository settings, under Moderation options, you can enable Code of conduct and Automated security fixes (the latter is for code, not comments). For comments, consider using GitHub’s built-in rate limiting that automatically hides comments from new accounts that contain links.
• Keep a record. Before deleting or blocking, screenshot the spam and note the timestamp. This helps if you need to escalate to GitHub support.
• Use the “Report” feature on the user’s profile. If a user is spamming across multiple advisories, report their profile directly via the Block or Report button on their profile page.
• If you’re not a maintainer, still report. Even if you can’t delete or block, reporting the comment is the most effective action you can take.

Troubleshooting

• You don’t see the “Lock conversation” button. This button only appears if you have write or admin access to the repository. If you’re a contributor without write access, you can’t lock it. Ask a maintainer to do it.
• The “Report content” option is missing. This can happen if you’re viewing the page in a mobile browser or if the comment is already minimized. Try opening the comment in a new tab, or use the “Report” link on the user’s profile page.
• Blocking a user doesn’t stop them from seeing the advisory. Blocking only prevents them from interacting with your repositories. They can still view public pages. If they’re posting abusive content elsewhere, report it to GitHub.
• Spam persists after you lock the conversation. Locking prevents new comments, but existing spam comments remain. You need to delete or minimize them manually. Also, check if the spam is in the advisory’s description—edit that separately.
• You accidentally blocked a legitimate user. Go to the blocked user’s profile (or search for them), click Block or Report, and select Unblock user. They’ll be able to comment again immediately.
• GitHub support hasn’t responded to your report. Reports are usually reviewed within a few days. If it’s urgent, you can contact GitHub Support directly via https://support.github.com with the advisory URL and the username.

Frequently Asked Questions

Can I block someone from commenting only on the advisory, not the whole repo?

No. GitHub doesn’t offer per-issue blocking. You can lock the conversation, which stops everyone except maintainers, or block the user entirely from your repositories.

What happens when I lock a conversation?

Only users with write access (maintainers) can comment. Everyone else sees a “Locked” notice. Existing comments remain visible unless you delete them.

Will reporting a comment automatically delete it?

No. Reporting sends it to GitHub for review. The comment stays until GitHub takes action or you delete it manually.

Can I block a user from a private repository advisory?

Yes, if you have admin access to that private repository. Blocking works the same as for public repositories.

Do interaction limits apply to advisories?

Yes, interaction limits apply to all issues and pull requests in the repository, including security advisories. However, they don’t affect existing comments.

What if the spam is in the advisory’s metadata (e.g., the title)?

Edit the advisory directly. Only maintainers can edit. Remove the spam and save. If the advisory is published, the change will be visible immediately.

Related

• Grounded Sci-Fi Mind-Bending Movies That Stay on Earth
• Smart Relays vs Smart Bulbs: Why People Switch
• Best VLC Alternatives: PotPlayer & Top Picks