List security advisories

GET/repos/{owner}/{name}/security/advisories

Anyone who can see the repository sees the published ones; those who see its findings (Write, or a security manager) see drafts and withdrawn ones too. Filter by state (draft, published, withdrawn).

Without a token, or with one that has no Write on the repository, only published advisories are listed. state filters to draft, published or withdrawn; drafts and withdrawn advisories are shown only to those who see the repository’s findings.

• Authentication: Required. Send an access token as Authorization: Bearer.
• MCP tool: security with action advisories, and the same inputs
• Scope: An access token needs security:read.

Path parameters

Name	Type	Required	Description
owner	string	Yes	The workspace that owns the repository.
name	string	Yes	The repository’s name.

Query parameters

Name	Type	Required	Description
state	string	No	Only advisories in this state. One of draft, published, withdrawn.

Example request

curl "https://api.g1t.sh/repos/flagon-io/hello/security/advisories?state=published" \
  -H "Authorization: Bearer $G1T_TOKEN"

Example response

A successful request answers 200 with:

[
  {
    "id": "adv_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "g1tsa_id": "G1TSA-2026-h7kd-3mqw",
    "repo_id": "rep_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "repo": "flagon-io/hello",
    "title": "Path traversal in the archive reader",
    "description": "A crafted archive could write outside the directory it is extracted to.\n\nUpgrade to 1.4.1.",
    "severity": "high",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
    "cvss_score": 8.1,
    "cve_id": "CVE-2026-12345",
    "ecosystem": "npm",
    "package": "@flagon/hello",
    "affected_versions": ">= 1.2.0, < 1.4.1",
    "patched_versions": ">= 1.4.1",
    "state": "published",
    "credits": [
      "ana"
    ],
    "report_id": "vrp_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "created_by": "syntaqx",
    "created_at": "2026-10-06T09:14:02.118Z",
    "updated_at": "2026-10-07T15:02:40.000Z",
    "published_at": "2026-10-07T15:02:40.000Z",
    "withdrawn_at": null
  }
]

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	unauthenticated	A token is required, or the one sent is not valid.
403	forbidden	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	not_found	It does not exist, or you cannot see it.
422	invalid	The input is not valid. message says which field and why.