GitHub Security Advisories Scraper

Read public GitHub Security Advisory Database list and detail pages and emit one flat row per unique advisory. The Actor uses ordinary HTTPS requests to github.com/advisories; it does not require a GitHub token or login.

Public source behavior

Public advisory pages expose the GHSA/CVE identifiers, title, severity, CVSS score/vector, EPSS percentage, CWE IDs, affected and patched version text, references, publication/update timestamps, advisory type, and withdrawn state. The parser omits UI placeholders such as “Unknown” and “No package listed” instead of fabricating values.

Input

{
  "query": "severity:high ecosystem:npm",
  "maxItems": 5
}

You can also provide ghsaId/ghsaIds for direct public detail lookups, or use convenience filters for CVE, ecosystem, severity, CWE, affected package, type, publication/update dates, and withdrawn advisories. maxItems is bounded to 1–1,000. fixtureFile accepts a repository-relative HTML fixture for deterministic local validation; proxyConfiguration is accepted for compatibility but this implementation uses direct public GitHub pages.

Dataset output

Normal rows contain public advisory identity, description, severity/CVSS/EPSS data, affected package/version text, references, timestamps, canonical advisory URL, query/source URL, and scrapedAt. Internal record IDs/types, status/data flags, source-website markers, and request metadata are not emitted. Request/no-result failures are minimal diagnostics containing only url, error, errorCode, and scrapedAt. Run status and counts are stored in the OUTPUT key-value record.

{
  "advisoryId": "GHSA-RHX5-89FH-523V",
  "ghsaId": "GHSA-RHX5-89FH-523V",
  "cveId": "CVE-2026-19883",
  "title": "A public advisory title",
  "severity": "high",
  "cvssScore": 8.8,
  "cwes": ["CWE-269"],
  "url": "https://github.com/advisories/GHSA-RHX5-89FH-523V",
  "sourceUrl": "https://github.com/advisories?query=severity%3Ahigh",
  "scrapedAt": "2026-09-08T00:00:00.000Z"
}

You can download the dataset in various formats such as JSON, HTML, CSV, or Excel.

Local run and validation

npm ci
npm test
npm run lint
apify validate-schema
apify run --purge --input-file .actor/input.json
apify run --purge --input-file test/inputs/live-smoke.json
npm run validate

The Actor follows bounded pagination and retries, fails closed on redirects outside the public GitHub advisories host, and does not bypass CAPTCHA, login, rate limits, or access controls. Respect GitHub's terms and public-service limits.