Update a security advisory

PATCH/repos/{owner}/{name}/security/advisories/{id}

A published advisory’s change is visible at once. Admin, or a security manager.

What the request leaves out stays as it is. A published advisory may be changed; its page shows the change at once.

• Authentication: Required. Send an access token as Authorization: Bearer.
• MCP tool: security with action update_advisory, and the same inputs
• Scope: An access token needs security:write.

Path parameters

Name	Type	Required	Description
owner	string	Yes	The workspace that owns the repository.
name	string	Yes	The repository’s name.
id	string	Yes	The advisory’s id: adv_…, or its G1TSA-… id.

Body parameters

Send a JSON object. Names are snake_case, as in responses; the camelCase spelling is accepted too.

Name	Type	Required	Description
title	string	No	One line: what the vulnerability is. At most 200 characters.
description	string	No	Markdown: what is affected, how it is exploited, what to do. At most 20,000 characters.
severity	string	No	How bad it is. One of critical, high, medium, low.
cvss_vector	string	No	A CVSS vector string, when scored: CVSS:3.1/AV:N/…
cvss_score	number	No	The CVSS base score, 0 to 10.
cve_id	string	No	CVE-2026-12345, when one was issued elsewhere.
ecosystem	string	No	How the affected package is distributed: npm, crates.io, Go, PyPI, or how the project ships.
package	string	No	The package affected.
affected_versions	string	No	The versions affected, as a range: >= 1.2.0, < 1.4.1
patched_versions	string	No	The versions that fix it: >= 1.4.1
credits	array of strings	No	Who found or fixed it: usernames or names, up to 20.

Example request

curl -X PATCH https://api.g1t.sh/repos/flagon-io/hello/security/advisories/adv_01kq2p9f6g7h8j9k0m1n2p3q4r \
  -H "Authorization: Bearer $G1T_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "cve_id": "CVE-2026-12345",
    "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
    "cvss_score": 8.1
  }'

Example response

A successful request answers 200 with:

{
  "id": "adv_01kq2p9f6g7h8j9k0m1n2p3q4r",
  "g1tsa_id": "G1TSA-2026-h7kd-3mqw",
  "repo_id": "rep_01kq2p9f6g7h8j9k0m1n2p3q4r",
  "repo": "flagon-io/hello",
  "title": "Path traversal in the archive reader",
  "description": "A crafted archive could write outside the directory it is extracted to.",
  "severity": "high",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
  "cvss_score": 8.1,
  "cve_id": "CVE-2026-12345",
  "ecosystem": "npm",
  "package": "@flagon/hello",
  "affected_versions": ">= 1.2.0, < 1.4.1",
  "patched_versions": ">= 1.4.1",
  "state": "draft",
  "credits": [
    "ana"
  ],
  "report_id": null,
  "created_by": "syntaqx",
  "created_at": "2026-10-06T09:14:02.118Z",
  "updated_at": "2026-10-06T10:30:00.000Z",
  "published_at": null,
  "withdrawn_at": null
}

Errors

A failed request answers with one of these statuses and a body like {"error": {"code": "not_found", "message": "Repository not found."}}. See errors.

Status	Code	When
401	unauthenticated	A token is required, or the one sent is not valid.
403	forbidden	The token is valid but not allowed to do this, such as a member-only change or an agent token outside its repository.
404	not_found	It does not exist, or you cannot see it.
409	conflict	The request conflicts with the current state.
422	invalid	The input is not valid. message says which field and why.