Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Characterizing and Modeling the GitHub Security Advisories Review Pipeline

Claudio Segal, Paulo Segal, Carlos Eduardo de Schuller Banjar, Felipe Paixão, Hudson Silva Borges, Paulo Silveira Neto, Eduardo Santana de Almeida, Joanna C. S. Santos, Anton Kocheturov, Gaurav Kumar Srivastava, Daniel Sadoc Menasché

TL;DR

The paper addresses how GHSA reviews unfold in open-source vulnerability disclosure, revealing a dual-path latency structure where GRAs accelerate reviews compared to NVD-first advisories. It combines large-scale empirical analysis with a simple queueing model to explain why GRAs are reviewed faster and how NVD automation influences timing post-2022. Key contributions include a detailed socio-technical characterization of GHSA actors, a comparative timing analysis (publication-to-review and patch-to-review), and a tractable model that supports what-if analyses for disclosure strategies. The findings have practical implications for vulnerability triage, automation tooling, and policy design, highlighting GHSA’s hub role and suggesting optimizations to shorten exposure windows across ecosystems.

Abstract

GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of GHSA review processes, analyzing over 288,000 advisories spanning 2019--2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.

Characterizing and Modeling the GitHub Security Advisories Review Pipeline

TL;DR

The paper addresses how GHSA reviews unfold in open-source vulnerability disclosure, revealing a dual-path latency structure where GRAs accelerate reviews compared to NVD-first advisories. It combines large-scale empirical analysis with a simple queueing model to explain why GRAs are reviewed faster and how NVD automation influences timing post-2022. Key contributions include a detailed socio-technical characterization of GHSA actors, a comparative timing analysis (publication-to-review and patch-to-review), and a tractable model that supports what-if analyses for disclosure strategies. The findings have practical implications for vulnerability triage, automation tooling, and policy design, highlighting GHSA’s hub role and suggesting optimizations to shorten exposure windows across ecosystems.

Abstract

GitHub Security Advisories (GHSA) have become a central component of open-source vulnerability disclosure and are widely used by developers and security tools. A distinctive feature of GHSA is that only a fraction of advisories are reviewed by GitHub, while the mechanisms associated with this review process remain poorly understood. In this paper, we conduct a large-scale empirical study of GHSA review processes, analyzing over 288,000 advisories spanning 2019--2025. We characterize which advisories are more likely to be reviewed, quantify review delays, and identify two distinct review-latency regimes: a fast path dominated by GitHub Repository Advisories (GRAs) and a slow path dominated by NVD-first advisories. We further develop a queueing model that accounts for this dichotomy based on the structure of the advisory processing pipeline.
Paper Structure (39 sections, 1 equation, 7 figures, 8 tables)

This paper contains 39 sections, 1 equation, 7 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Mining Methodology and Goals
  4. Data enrichment
  5. (a) Temporal enrichment:
  6. (b) User and repository enrichment:
  7. Research Questions
  8. RQ1--RQ4: Users Engagement and Repository Characteristics
  9. User Roles
  10. Specialization
  11. An Actor-Critic Perspective towards Roles
  12. Repository Characteristics
  13. Dataset
  14. Analysis
  15. RQ5--RQ7: Empirical Characterization of Review Pipeline
  16. ...and 24 more sections

Figures (7)

  • Figure 1: Repository characteristics box plot.
  • Figure 2: Reviewer experience at review time (ECDF) for GRA vs. non-GRA advisories, and for all advisories combined.
  • Figure 3: Reviews per month by source
  • Figure 4: Flow of reviewed GHSA across platforms.
  • Figure 5: Median review time by publish month by source
  • ...and 2 more figures