Report a vulnerability privately

POST/repos/{owner}/{name}/security/reports

Needs private vulnerability reporting on for the repository. Anyone who can see the repository may report; on a public one you may report without a token by giving an email the maintainers can answer at. At most 5 reports a day per reporter and repository. The workspace’s owners and security managers are told at once. You see only your own report.

Needs private vulnerability reporting on for the repository (409 otherwise). With a token, the report is yours by username; without one, on a public repository, give email, or the request is 422. The workspace’s owners and security managers are told at once. More than 5 reports a day from one reporter to one repository, or a repository with 50 new reports waiting, is refused.

• Authentication: Required. Send an access token as Authorization: Bearer.
• MCP tool: security with action report_vulnerability, and the same inputs
• Scope: An access token needs security:write.

Path parameters

Name	Type	Required	Description
owner	string	Yes	The workspace that owns the repository.
name	string	Yes	The repository’s name.

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
title	string	Yes	One line: what you found. At most 200 characters.
description	string	Yes	What is affected and how to reproduce it. At most 20,000 characters.
severity	string	No	How bad you think it is, if you like. One of critical, high, medium, low.
email	string	No	Without a token: where the maintainers can answer you.

Example request

curl -X POST https://api.g1t.sh/repos/flagon-io/hello/security/reports \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Path traversal in the archive reader",
    "description": "Extracting an archive with an entry named ../../etc/passwd writes outside the target directory. Steps: …",
    "severity": "high",
    "email": "finder@example.com"
  }'

Example response

A successful request answers 200 with:

{
  "id": "vrp_01kq2p9f6g7h8j9k0m1n2p3q4r",
  "repo_id": "rep_01kq2p9f6g7h8j9k0m1n2p3q4r",
  "repo": "flagon-io/hello",
  "reporter": null,
  "reporter_email": "finder@example.com",
  "title": "Path traversal in the archive reader",
  "description": "Extracting an archive with an entry named ../../etc/passwd writes outside the target directory. Steps: …",
  "severity": "high",
  "state": "new",
  "advisory_id": null,
  "created_at": "2026-10-06T08:40:11.000Z",
  "reviewed_by": null,
  "reviewed_at": null,
  "review_note": null
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	unauthenticated	A token is required, or the one sent is not valid.
403	forbidden	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	not_found	It does not exist, or you cannot see it.
409	conflict	The request conflicts with the current state.
422	invalid	The input is not valid. message says which field and why.