What is the purpose of creating private advisories in GAS?

• A. To publish immediately to users.
• B. To publish advisories publicly before coordination.
• C. To coordinate disclosure with maintainers before public release.
• D. To generate SBOMs.

Answer: (C)

Private advisories in GAS are for coordinating disclosure with maintainers before making details public. This allows researchers to privately share vulnerability specifics, gather necessary information, and give the project time to reproduce, verify, and fix the issue without exposing details that could be exploited. The maintainers can prepare a patch and guidance, and the advisory can be released publicly only once a fix is ready, with users informed accordingly. It’s not about publishing immediately or publicly before coordination, and it’s not specifically for generating SBOMs.