A repository security advisory is a coordinated disclosure record used by code hosting platforms such as GitHub to report, track, and fix vulnerabilities in repositories and their related software. It lets maintainers share technical details privately, assign a severity, and publish remediation guidance when the issue is ready for public disclosure.
This matters because it helps defenders patch faster without giving attackers an early blueprint. In practice, advisories often link to affected versions, CVE identifiers, fixes, and backported patches. Attackers may monitor public advisories and related proof-of-concept code to find exposed systems, while defenders use them to inventory dependencies, confirm whether they are affected, and prioritize updates before exploitation spreads through a supply chain.