Security advisories

Accept or decline a vulnerability report

Accept a report (decision accept), which makes a draft advisory from it crediting the reporter, or decline it (decision decline), with an optional note.

PATCH/repos/{owner}/{name}/security/reports/{id}

Admin, or a security manager.

accept makes a draft advisory from the report, in the report’s words and crediting the reporter, for the maintainers to finish and publish; advisory is that draft. decline closes the report; advisory is null. A report that was reviewed already is 409. Takes the Admin role, or a security manager of the workspace.

Authentication: Required. Send an access token as Authorization: Bearer.
MCP tool: security with action review_report, and the same inputs
Scope: An access token needs security:write.

Path parameters

Name	Type	Required	Description
`owner`	string	Yes	The workspace that owns the repository.
`name`	string	Yes	The repository’s name.
`id`	string	Yes	The report’s id: vrp_…

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
`decision`	string	Yes	accept makes a draft advisory from it; decline closes it. One of `accept`, `decline`.
`note`	string	No	A note for the record, in a sentence. At most 1,000 characters.

Example request

curl -X PATCH https://api.g1t.sh/repos/flagon-io/hello/security/reports/vrp_01kq2p9f6g7h8j9k0m1n2p3q4r \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "decision": "accept",
    "note": "Confirmed on 1.4.0."
  }'

Example response

A successful request answers 200 with:

{
  "report": {
    "id": "vrp_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "repo_id": "rep_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "repo": "flagon-io/hello",
    "reporter": null,
    "reporter_email": "finder@example.com",
    "title": "Path traversal in the archive reader",
    "description": "Extracting an archive with an entry named ../../etc/passwd writes outside the target directory. Steps: …",
    "severity": "high",
    "state": "accepted",
    "advisory_id": "adv_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "created_at": "2026-10-06T08:40:11.000Z",
    "reviewed_by": "syntaqx",
    "reviewed_at": "2026-10-06T09:14:02.118Z",
    "review_note": "Confirmed on 1.4.0."
  },
  "advisory": {
    "id": "adv_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "g1tsa_id": "G1TSA-2026-h7kd-3mqw",
    "repo_id": "rep_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "repo": "flagon-io/hello",
    "title": "Path traversal in the archive reader",
    "description": "Extracting an archive with an entry named ../../etc/passwd writes outside the target directory. Steps: …",
    "severity": "high",
    "cvss_vector": null,
    "cvss_score": null,
    "cve_id": null,
    "ecosystem": null,
    "package": null,
    "affected_versions": null,
    "patched_versions": null,
    "state": "draft",
    "credits": [
      "finder@example.com"
    ],
    "report_id": "vrp_01kq2p9f6g7h8j9k0m1n2p3q4r",
    "created_by": "syntaqx",
    "created_at": "2026-10-06T09:14:02.118Z",
    "updated_at": "2026-10-06T09:14:02.118Z",
    "published_at": null,
    "withdrawn_at": null
  }
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	`unauthenticated`	A token is required, or the one sent is not valid.
403	`forbidden`	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	`not_found`	It does not exist, or you cannot see it.
409	`conflict`	The request conflicts with the current state.
422	`invalid`	The input is not valid. `message` says which field and why.