What’s new?
Vendor claim: GitHub now allows you to block a user directly from a security advisory description or comment without leaving the page. This feature is available on public repositories owned by organizations or personal accounts.
Why it matters
Security advisories often contain user‑generated content such as comments and references. Like issues or pull requests, these pages can become targets for spam or harassment. Previously, moderators had to navigate to separate settings pages to block a problematic user, which was time‑consuming and disrupted the moderation workflow.
How it works
- Open a security advisory in a public repository.
- Click the three‑dot menu on the advisory description or any comment.
- Select “Block user” from the dropdown.
- Review the confirmation dialog that explains the impact of the block.
- Confirm to block the user; the advisory remains intact while the blocker’s contributions are hidden.
Who can block?
In organization‑owned repositories, only moderators or administrators can initiate a block. In personal‑account repositories, the account owner has the authority to block users.
Implications for security moderation
This addition aligns security advisories with the moderation experience already available for issues and pull requests, reducing friction for maintainers dealing with abusive behavior. By keeping the advisory visible, the community retains access to critical vulnerability information while the source of abuse is removed.
Next steps
Repository owners should familiarize themselves with the new block option and consider updating their moderation guidelines to incorporate it. Feedback can be shared through the GitHub Community discussion linked in the changelog.