# GitHub Security Advisories Scraper (`automation-lab/github-security-advisories-scraper`) Actor Monitor GHSA and CVE advisories from GitHub’s official API with ecosystem, severity, package, and date filters for DevSecOps feeds. - **URL**: https://apify.com/automation-lab/github-security-advisories-scraper.md - **Developed by:** [Stas Persiianenko](https://apify.com/automation-lab) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## GitHub Security Advisories Scraper Extract GHSA and CVE vulnerability advisories from GitHub's official Security Advisories API. Use this Apify Actor to build scheduled security feeds, export affected package metadata, monitor high and critical advisories, and send clean data into SIEM, vulnerability-management, or dependency-risk workflows. ### What does GitHub Security Advisories Scraper do? GitHub Security Advisories Scraper collects public Global Security Advisories from GitHub. It calls the official `api.github.com/advisories` endpoint. It saves one dataset item per advisory. Each item includes identifiers, severity, timestamps, links, CVSS data, CWE values, references, and affected packages. The actor is HTTP/API-only and does not use a browser. ### Who is it for? #### DevSecOps teams Track new GitHub Security Advisories for ecosystems your organization uses. #### Security analysts Export GHSA and CVE data into spreadsheets, dashboards, and alerting tools. #### Dependency-management vendors Build a scheduled vulnerability feed with normalized affected package fields. #### Open-source maintainers Monitor vulnerabilities affecting your packages, language ecosystem, or dependency graph. #### Data teams Collect advisory records from a stable public API without writing pagination and schema code. ### Why use this actor? - ✅ Uses GitHub's official public REST API - ✅ No login required for normal public runs - ✅ Optional GitHub token for higher API rate limits - ✅ Filters by ecosystem, severity, package, CVE, GHSA, and dates - ✅ Normalizes nested vulnerability package/version data - ✅ Works well as a scheduled monitoring job - ✅ Outputs structured JSON ready for exports and integrations ### What data can you extract? | Field | Description | |---|---| | `ghsaId` | GitHub Security Advisory identifier | | `cveId` | CVE identifier when available | | `summary` | Advisory summary | | `description` | Full advisory text from GitHub | | `severity` | GitHub severity value | | `cvss` | CVSS vector and score when available | | `cwes` | CWE identifiers | | `identifiers` | GHSA/CVE identifier list | | `publishedAt` | Published timestamp | | `updatedAt` | Updated timestamp | | `withdrawnAt` | Withdrawn timestamp when applicable | | `htmlUrl` | Human-readable GitHub advisory URL | | `references` | Reference links | | `vulnerabilities` | Affected packages, version ranges, patches, functions | | `affectedEcosystems` | Deduplicated ecosystems | | `affectedPackages` | Deduplicated package names | | `scrapedAt` | Actor extraction timestamp | ### How much does it cost to scrape GitHub Security Advisories? This actor uses pay-per-event pricing. There is a small run-start event. There is a per-advisory event for each dataset item saved. The formula-derived BRONZE per-advisory price is about $0.000028567, with lower prices on higher Apify tiers. Because the actor uses the official API and no proxy, typical run costs are low. Use `maxItems` to control the size of scheduled runs. ### Quick start 1. Open the actor on Apify. 2. Set `maxItems` to the number of advisories you need. 3. Optionally choose ecosystems such as `npm`, `pip`, `maven`, or `go`. 4. Optionally choose severities such as `critical` and `high`. 5. Click **Start**. 6. Export the dataset as JSON, CSV, Excel, XML, RSS, or HTML. ### Input options #### Maximum advisories `maxItems` limits the number of advisory records saved. The default is 20. #### Ecosystems Use `ecosystems` to filter affected package ecosystems. Examples: - `npm` - `pip` - `maven` - `rubygems` - `go` - `composer` - `nuget` - `rust` - `actions` #### Severities Use `severities` to keep selected severity levels. Supported values: - `low` - `medium` - `high` - `critical` #### Affected package Use `affectedPackage` to search advisories affecting a package name. Examples: - `react` - `django` - `spring-framework` - `lodash` #### CVE ID Use `cveId` for exact CVE lookups. Example: `CVE-2024-12345`. #### GHSA ID Use `ghsaId` for exact GitHub Security Advisory lookups. Example: `GHSA-xxxx-yyyy-zzzz`. #### Date filters Use `publishedSince`, `publishedUntil`, `updatedSince`, and `updatedUntil` for monitoring windows. These filters accept ISO date strings. Examples: - `2026-01-01` - `2026-06-01T00:00:00Z` #### Include withdrawn advisories `includeWithdrawn` controls whether withdrawn advisories are included. It is disabled by default. #### GitHub token `githubToken` is optional. Provide a GitHub token when you need higher API rate limits. The token is marked secret in the input schema. ### Example input ```json { "maxItems": 20, "ecosystems": ["npm"], "severities": ["critical", "high"], "includeWithdrawn": false } ```` ### Example output ```json { "ghsaId": "GHSA-qrv3-253h-g69c", "cveId": "CVE-2026-0000", "severity": "high", "summary": "Example package advisory summary", "affectedEcosystems": ["npm"], "affectedPackages": ["example-package"], "publishedAt": "2026-06-27T12:00:00Z", "updatedAt": "2026-06-27T12:30:00Z", "htmlUrl": "https://github.com/advisories/GHSA-qrv3-253h-g69c" } ``` ### Monitoring new high-severity npm advisories Use this input for a scheduled npm monitoring feed: ```json { "maxItems": 20, "ecosystems": ["npm"], "severities": ["critical", "high"], "publishedSince": "2026-01-01" } ``` Run it daily or hourly depending on your workflow. ### Monitoring one package Use `affectedPackage` when you care about a specific dependency. ```json { "maxItems": 50, "affectedPackage": "django", "severities": ["critical", "high", "medium"] } ``` ### Export formats Apify datasets can be exported as: - JSON - CSV - Excel - XML - RSS - HTML table ### Integrations #### Slack or email alerts Schedule this actor and connect the dataset to an automation that alerts on new `critical` advisories. #### SIEM enrichment Export GHSA, CVE, CVSS, package, and reference fields into your SIEM pipeline. #### Dependency risk dashboards Load the dataset into BI tools to track vulnerability trends by ecosystem or package. #### Vulnerability triage queues Use `severity`, `affectedPackages`, and `publishedAt` fields to route advisory review. ### API usage with Node.js ```js import { ApifyClient } from 'apify-client'; const client = new ApifyClient({ token: process.env.APIFY_TOKEN }); const run = await client.actor('automation-lab/github-security-advisories-scraper').call({ maxItems: 100, ecosystems: ['npm'], severities: ['critical', 'high'] }); console.log(run.defaultDatasetId); ``` ### API usage with Python ```python from apify_client import ApifyClient client = ApifyClient('MY-APIFY-TOKEN') run = client.actor('automation-lab/github-security-advisories-scraper').call(run_input={ 'maxItems': 100, 'ecosystems': ['pip'], 'severities': ['critical', 'high'], }) print(run['defaultDatasetId']) ``` ### API usage with cURL ```bash curl -X POST 'https://api.apify.com/v2/acts/automation-lab~github-security-advisories-scraper/runs?token=MY-APIFY-TOKEN' \ -H 'Content-Type: application/json' \ -d '{"maxItems":100,"ecosystems":["npm"],"severities":["critical","high"]}' ``` ### MCP usage Use Apify MCP from Claude Desktop or Claude Code with this actor tool enabled. MCP URL: ```text https://mcp.apify.com/?tools=automation-lab/github-security-advisories-scraper ``` Claude Code setup: ```bash claude mcp add apify-security-advisories https://mcp.apify.com/?tools=automation-lab/github-security-advisories-scraper ``` Claude Desktop JSON config: ```json { "mcpServers": { "apify-security-advisories": { "url": "https://mcp.apify.com/?tools=automation-lab/github-security-advisories-scraper" } } } ``` Example prompts: - "Run the GitHub Security Advisories Scraper for critical npm advisories and summarize the latest packages." - "Find high severity GHSA records affecting Django and list patched versions." - "Export the latest 100 high severity GitHub advisories as a table." ### Tips for best results - Keep `maxItems` modest for frequent scheduled runs. - Use a GitHub token if you run many security-feed jobs. - Filter by ecosystem to reduce noise. - Filter by severity for alerting workflows. - Use date filters to create rolling monitoring windows. - Store the last run timestamp in your own workflow if you need incremental alerts. ### Rate limits Unauthenticated GitHub API calls have lower rate limits. Authenticated calls have higher rate limits. If GitHub returns a rate-limit error, add a token or retry after the reset time shown in the actor log. ### Data freshness The actor reads directly from GitHub during each run. Freshness depends on GitHub's public advisory API. Scheduled runs are recommended for monitoring workflows. ### Limitations The actor does not scan your private repositories. The actor does not determine whether your application is exploitable. It extracts public advisory records and affected package metadata. ### Legality This actor uses GitHub's public API for publicly available security advisory data. Review GitHub's API terms and your organization's data policy before automated use. Use optional tokens responsibly and do not exceed API limits. ### FAQ #### Is this a GitHub CVE scraper? Yes. It extracts public GitHub Security Advisories and includes CVE identifiers when GitHub provides them. #### Can I run it on a schedule? Yes. The actor is designed for scheduled DevSecOps monitoring and recurring advisory exports. ### Troubleshooting #### Why did I get a rate-limit error? GitHub may limit unauthenticated API calls. Add `githubToken` or retry after the reset time in the log. #### Why are there no results? Your filters may be too narrow. Try removing date filters, severity filters, or package filters. #### Why is `cveId` empty? Some GitHub advisories do not have a CVE identifier. Use `ghsaId` as the stable GitHub advisory identifier. ### Related scrapers Explore other automation-lab actors for security, developer, and monitoring workflows: - https://apify.com/automation-lab/http-status-code-checker - https://apify.com/automation-lab/bulk-url-status-checker - https://apify.com/automation-lab/website-contact-finder ### Support If you need a field that is available in GitHub's advisory API but missing from the dataset, open an Apify issue with a sample advisory URL. ### Changelog #### 0.1 Initial version with official GitHub advisory API extraction, filters, normalized affected package fields, and optional GitHub token support. # Actor input Schema ## `maxItems` (type: `integer`): Maximum number of advisory records to save to the dataset. ## `ecosystems` (type: `array`): Optional GitHub advisory ecosystems to include. Use values such as npm, pip, maven, rubygems, go, composer, nuget, rust, actions, pub, swift, or erlang. ## `severities` (type: `array`): Optional severity levels to include. Leave empty for all severities. ## `affectedPackage` (type: `string`): Optional package name to filter with GitHub's affects parameter, for example react, django, spring-framework, or lodash. ## `cveId` (type: `string`): Optional exact CVE identifier, for example CVE-2024-12345. ## `ghsaId` (type: `string`): Optional exact GitHub Security Advisory identifier, for example GHSA-xxxx-yyyy-zzzz. ## `publishedSince` (type: `string`): Keep only advisories published on or after this ISO date/time. Example: 2026-01-01. ## `publishedUntil` (type: `string`): Keep only advisories published on or before this ISO date/time. ## `updatedSince` (type: `string`): Keep only advisories updated on or after this ISO date/time. ## `updatedUntil` (type: `string`): Keep only advisories updated on or before this ISO date/time. ## `includeWithdrawn` (type: `boolean`): Include advisories that GitHub marks as withdrawn. Disabled by default for monitoring workflows. ## `githubToken` (type: `string`): Optional fine-grained or classic GitHub token for higher API rate limits. The actor works without a token for normal public runs. ## Actor input object example ```json { "maxItems": 20, "ecosystems": [ "npm" ], "severities": [ "critical", "high" ], "includeWithdrawn": false } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "maxItems": 20, "ecosystems": [ "npm" ], "severities": [ "critical", "high" ], "includeWithdrawn": false }; // Run the Actor and wait for it to finish const run = await client.actor("automation-lab/github-security-advisories-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "maxItems": 20, "ecosystems": ["npm"], "severities": [ "critical", "high", ], "includeWithdrawn": False, } # Run the Actor and wait for it to finish run = client.actor("automation-lab/github-security-advisories-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "maxItems": 20, "ecosystems": [ "npm" ], "severities": [ "critical", "high" ], "includeWithdrawn": false }' | apify call automation-lab/github-security-advisories-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=automation-lab/github-security-advisories-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "GitHub Security Advisories Scraper", "description": "Monitor GHSA and CVE advisories from GitHub’s official API with ecosystem, severity, package, and date filters for DevSecOps feeds.", "version": "0.1", "x-build-id": "trQZ7DKxDU3PZ2nXn" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/automation-lab~github-security-advisories-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-automation-lab-github-security-advisories-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/automation-lab~github-security-advisories-scraper/runs": { "post": { "operationId": "runs-sync-automation-lab-github-security-advisories-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/automation-lab~github-security-advisories-scraper/run-sync": { "post": { "operationId": "run-sync-automation-lab-github-security-advisories-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "maxItems": { "title": "Maximum advisories", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Maximum number of advisory records to save to the dataset.", "default": 20 }, "ecosystems": { "title": "Ecosystems", "type": "array", "description": "Optional GitHub advisory ecosystems to include. Use values such as npm, pip, maven, rubygems, go, composer, nuget, rust, actions, pub, swift, or erlang.", "items": { "type": "string" } }, "severities": { "title": "Severities", "type": "array", "description": "Optional severity levels to include. Leave empty for all severities.", "items": { "type": "string" } }, "affectedPackage": { "title": "Affected package", "type": "string", "description": "Optional package name to filter with GitHub's affects parameter, for example react, django, spring-framework, or lodash." }, "cveId": { "title": "CVE ID", "type": "string", "description": "Optional exact CVE identifier, for example CVE-2024-12345." }, "ghsaId": { "title": "GHSA ID", "type": "string", "description": "Optional exact GitHub Security Advisory identifier, for example GHSA-xxxx-yyyy-zzzz." }, "publishedSince": { "title": "Published since", "type": "string", "description": "Keep only advisories published on or after this ISO date/time. Example: 2026-01-01." }, "publishedUntil": { "title": "Published until", "type": "string", "description": "Keep only advisories published on or before this ISO date/time." }, "updatedSince": { "title": "Updated since", "type": "string", "description": "Keep only advisories updated on or after this ISO date/time." }, "updatedUntil": { "title": "Updated until", "type": "string", "description": "Keep only advisories updated on or before this ISO date/time." }, "includeWithdrawn": { "title": "Include withdrawn advisories", "type": "boolean", "description": "Include advisories that GitHub marks as withdrawn. Disabled by default for monitoring workflows.", "default": false }, "githubToken": { "title": "GitHub token (optional)", "type": "string", "description": "Optional fine-grained or classic GitHub token for higher API rate limits. The actor works without a token for normal public runs." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```