GitHub now lets repository moderators and administrators block a user directly from a security advisory page, without leaving the page or navigating to separate settings. The feature works in both organization-owned and personal account-owned public repositories and extends the same moderation flow already available for issues and pull requests. Organization moderators or admins can initiate blocks in org repos, while personal account owners can do so in their own repos, keeping the advisory content intact while removing abusive or spammy contributors.
Questions this post answers
How can I block a spammy user who commented on a GitHub security advisory?
GitHub now lets you block a user directly from the security advisory page itself, using the three-dot menu on the advisory description or a comment. This removes the need to navigate to organization settings, personal settings, or the user's profile. A confirmation dialog shows what blocking means before the action is taken, and the advisory content stays intact. Maintainers tracking new GitHub moderation tools can follow release notes like this on daily.dev.
Who is allowed to block a user from a security advisory on GitHub?
In organization-owned repositories, only organization moderators or administrators can initiate a block from a security advisory. In personal account-owned repositories, only the account owner can initiate the block. This mirrors the permission model already used for blocking from issues and pull requests. Repo admins deciding who gets moderation powers can keep up with GitHub permission changes on daily.dev.