Security Advisory Credits Not Appearing on Profile Despite Being Credited in 6 CVEs

[adityaax]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Other

Body

Hello,

I have been credited as the reporter in multiple public GitHub Security Advisories and currently have 6 CVEs assigned through GitHub's CNA process. My GitHub username appears in the Credits section of the corresponding advisories; however, I do not see any Security Advisory credit reflected on my GitHub profile's Highlights section.

You can check my profile for the CVEs. However, one of the CVEs is CVE-2025-47289, where I am listed in the advisory credits - GHSA-98qq-m8qj-vvgj

I would appreciate any assistance or clarification you can provide.

Example-

Thank you for your time and support.

[adityaax]

Thanks, @DEVAL-020 , for the detailed explanation. I appreciate your willingness to help others. As you suggested, I created a support ticket and included all the details you mentioned. Community members like you are greatly appreciated and make a real difference by helping others navigate these issues.

Thank you again for your help!

[hemanth55244]

Security Advisory credits on GitHub profiles are not always added automatically. Even if you are listed in the Credits section of public advisories and have CVEs assigned through GitHub's CNA process, the profile highlight may not appear immediately or may require manual review.

Since your account-specific data cannot be reviewed by community members, please contact GitHub Support with links to the relevant advisories (including GHSA-98qq-m8qj-vvgj / CVE-2025-47289) and request that they verify the missing Security Advisory profile credit. Only GitHub Support can investigate and correct profile highlight issues.

[adityaax]

Thanks for the info.

[lissy93]

Bit late here, but AFAIK security credits only show for reports which get published to GitHub's Global Security Advisory (GHAD) database. Which is NOT the same as being in a repo's advisory tab.

If you see this in the report, then it the GHSA ID was reviewed by GitHub and published to their db, and you get the badge on your profile a few hours later.

For something to get published to GAD, it doesn't need a CVE. But it does need to be on a supported package ecosystems, with valid versions specified, and be a valid write-up (not over-stated), and have then been reviewed + published by GitHub.