# GitHub Security Advisories Scraper (`parseforge/github-security-advisories-scraper`) Actor

Scrapes GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, CWE, or date range. Returns each advisory as a flat row with description, affected packages, CVSS scores, and references. Export to CSV, JSON, Excel, or XML.

- **URL**: https://apify.com/parseforge/github-security-advisories-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Developer tools, Business, Automation
- **Stats:** 3 total users, 2 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $23.63 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner.jpg)](https://apify.com/parseforge?fpr=vmoqkp)

### GitHub Security Advisories Scraper

**Scrape GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, or date range, up to a million per run.** Every advisory comes with its full description, affected packages, CVSS scores, CWE IDs, and references. No API key or login required. Export to CSV, JSON, Excel, or XML.

GitHub's official GraphQL API needs a personal access token and rate-limits you. This reads the public GitHub Security Advisories database directly, filtered by GHSA ID, CVE, ecosystem, severity, CWE, or date range, and returns each match in one fixed schema. It covers reviewed, unreviewed, and malware advisories across npm, Maven, pip, Go, and more.

| Who uses it | What they scrape GitHub Security Advisories for |
|---|---|
| Security engineers | Which vulnerabilities affect the packages their applications depend on |
| DevSecOps teams | Monitoring new advisories for their tech stack to trigger patching workflows |
| Compliance officers | Auditing which CVEs and CWEs are present in their software inventory |
| Threat intelligence analysts | Tracking malware advisories and unreviewed reports across ecosystems |
| Open source maintainers | Checking if their packages appear in any advisory, including withdrawn ones |

### What it does

This Actor collects GitHub Security Advisories by GHSA ID, CVE, ecosystem, severity, CWE, or date range, and returns each one as a flat row.

- 🎯 **GHSA ID lookup:** fetch one advisory by its GHSA ID, or batch up to 100 IDs in a single run.
- 🔍 **CVE and CWE filters:** narrow to advisories linked to a specific CVE or a list of CWE numbers.
- 📦 **Ecosystem and package filters:** limit to npm, Maven, pip, Go, Rust, and more, or to specific packages and versions.
- 📅 **Date ranges:** filter by published, updated, or modified-after dates using ISO 8601 or range syntax.
- 🏷️ **Type and severity:** choose reviewed, unreviewed, or malware advisories, and filter by CVSS severity tier.
- 🚫 **Withdrawn only:** return only advisories that GitHub has withdrawn, useful for audit trails.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with GitHub Security Advisories data

**🛡️ Monitor your dependencies.**

A DevSecOps engineer runs the Actor daily with an ecosystem filter for npm and a severity of critical or high, then feeds new advisories into an alerting pipeline.

**📋 Enrich a CVE list.**

A security analyst passes a batch of CVE IDs to get the corresponding GHSA records, including affected packages and CVSS scores, for a vulnerability report.

**🧪 Audit for malware advisories.**

A threat researcher sets type to malware and ecosystem to pip to collect all Python malware advisories published in the last month.

**📊 Track advisory trends.**

A compliance officer filters by published date range and CWE IDs to see how many advisories match specific weakness classes over a quarter.

**🔎 Verify a specific advisory.**

An open source maintainer looks up a GHSA ID to check if their package is affected and whether the advisory has been withdrawn.

### Why choose this scraper

| | What you get |
|---|---|
| **No API key** | Uses the public GitHub Security Advisories database, no token or OAuth setup |
| **Fixed schema** | Every advisory returns the same flat fields, ready for CSV, JSON, Excel, or XML |
| **Batch lookups** | Pass up to 100 GHSA IDs in one run for efficient enrichment |
| **Full coverage** | Includes reviewed, unreviewed, and malware advisories, plus withdrawn ones |

### How it compares

No other Store actor targets GitHub Security Advisories the same way, so the honest comparison is with the alternatives teams actually weigh.

| | GitHub Security Advisories Scraper | Build it in-house | By hand |
|---|---|---|---|
| Setup | Run it now, zero config | Days of engineering | None, but hours per pull |
| When GitHub Security Advisories changes | Maintained for you | You fix it | You re-learn the page |
| Proxies, retries, anti-bot | Built in | Your problem | Browser only |
| Output | Fixed JSON schema, CSV/Excel export | Whatever you build | Copy-paste |
| Cost | Pay per result | Engineering time | Analyst hours |

### Configure the run

Drive the Actor from GHSA IDs, CVE IDs, ecosystems, severities, CWE numbers, or date ranges, alone or together, and filters run as each advisory is read so only matches reach your dataset. The Input tab lists every parameter.

A first run with the defaults:

```json
{
 "maxItems": 10
}
```

A larger pull:

```json
{
 "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.0315 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $3.15 |
| 1,000 results | $31.50 |
| 10,000 results | $315.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [GitHub Security Advisories Scraper](https://apify.com/parseforge/github-security-advisories-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to GitHub Security Advisories through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com/?tools=parseforge/github-security-advisories-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results?**

Check your filters. If you set a CVE ID, ecosystem, severity, or date range, the combination may be too narrow. Try removing filters one at a time to see which one excludes all advisories.

**Why does my batch lookup return fewer results than expected?**

The ghsaIds field takes precedence over a single ghsaId. Make sure you are not setting both, and verify that each GHSA ID is spelled correctly. Some IDs may not exist or may be withdrawn.

**Why do I get an error about the date format?**

Use ISO 8601 format like '2023-01-01' or a range like '2023-01-01..2023-12-31'. For modifiedAfter, a single date is translated to '>=date', but a range is passed as-is.

**Why are some fields empty in my results?**

Not all advisories have every field. For example, unreviewed advisories may lack a GHSA ID or CVSS score. Check the advisory type and source.

**Why does my run take a long time?**

If you set a high maxItems and broad filters, the Actor may need to paginate through many advisories. Reduce maxItems or add more specific filters like ecosystem or severity.

**Why do I get duplicate advisories?**

If you pass overlapping filters, such as both a CVE ID and a GHSA ID, the same advisory may match multiple criteria. The Actor returns each advisory once per run, but check your input for redundancy.

### FAQ

| Question | Answer |
|---|---|
| Do I need a GitHub API token? | No. This Actor reads the public GitHub Security Advisories database directly, so no authentication or API key is required. |
| What is a GHSA ID? | A GHSA ID is GitHub's unique identifier for a security advisory, formatted like GHSA-xxxx-xxxx-xxxx. You can find it in the advisory URL or in the GitHub Advisory Database. |
| Can I fetch multiple advisories at once? | Yes. Use the ghsaIds field to pass an array of up to about 100 GHSA IDs in a single run. |
| What ecosystems are supported? | The Actor supports npm, Maven, pip, Go, Rust, RubyGems, Composer, NuGet, Swift, pub, Erlang/Elixir, GitHub Actions, and other. |
| How do I filter by severity? | Use the severity field and choose critical, high, medium, low, or unknown. The filter matches the CVSS severity tier of the advisory. |
| Can I filter by CWE? | Yes. Pass a comma-separated list of CWE numbers in the cwes field, such as '79,89,787'. |
| What date filters are available? | You can filter by published date, updated date, or modified-after date. Use ISO 8601 dates or ranges like '2023-01-01..2023-12-31'. |
| Does the Actor include withdrawn advisories? | By default, withdrawn advisories are included. Set isWithdrawn to true to return only withdrawn advisories. |
| What is the difference between reviewed and unreviewed? | Reviewed advisories are curated by GitHub and have a GHSA ID. Unreviewed advisories come from community sources and may not have a GHSA ID. Malware advisories are a separate type for malicious packages. |
| How many advisories can I collect in one run? | You can set maxItems up to 1,000,000. The default is 10. |
| What output formats are supported? | The Actor exports to CSV, JSON, Excel, and XML, with a fixed schema for every advisory. |
| Can I filter by affected package? | Yes. Use the affects field with a comma-separated list of packages, optionally with versions like 'package1,package2@1.0.0'. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by GitHub, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `ghsaId` (type: `string`):

Fetch a specific advisory by GHSA ID (e.g. GHSA-652x-xj99-gmcc).

## `ghsaIds` (type: `array`):

Array of GHSA IDs to fetch in one run (e.g. \["GHSA-652x-xj99-gmcc", "GHSA-jfh8-c2jp-5v3q"]). Takes precedence over single ghsaId. Recommended max ~100 per call.

## `cveId` (type: `string`):

Filter to advisories with this CVE ID (e.g. CVE-2021-44228).

## `type` (type: `string`):

GitHub-reviewed advisories, community/unreviewed, or malware advisories.

## `severity` (type: `string`):

Filter by CVSS severity tier.

## `ecosystem` (type: `string`):

Filter by package ecosystem.

## `affects` (type: `string`):

Comma-separated list of packages (e.g. 'package1,package2@1.0.0') to filter advisories that affect them.

## `cwes` (type: `string`):

Comma-separated CWE numbers (e.g. '79,89,787').

## `cwesFilter` (type: `string`):

Alias for the cwes field. Comma-separated CWE numbers (e.g. '79,89,787').

## `published` (type: `string`):

Filter by publish date. Use ISO 8601 or a range like '2023-01-01..2023-12-31'.

## `updated` (type: `string`):

Filter by last-updated date.

## `modifiedAfter` (type: `string`):

Single date (YYYY-MM-DD) — translated to '>=date'. Pass a range like '2024-01-01..2024-12-31' to use as-is. Filters by the advisory's last-modified date.

## `isWithdrawn` (type: `boolean`):

When true, only withdrawn advisories are returned.

## `maxItems` (type: `integer`):

How many security advisories to collect per run.

## Actor input object example

```json
{
  "ghsaId": "",
  "ghsaIds": [],
  "cveId": "",
  "type": "",
  "severity": "",
  "ecosystem": "",
  "affects": "",
  "cwes": "",
  "cwesFilter": "",
  "published": "",
  "updated": "",
  "modifiedAfter": "",
  "isWithdrawn": false,
  "maxItems": 10
}
```

# Actor output Schema

## `overview` (type: `string`):

Overview of scraped data

## `fullData` (type: `string`):

Complete dataset

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ghsaId": "",
    "cveId": "",
    "type": "",
    "severity": "",
    "ecosystem": "",
    "affects": "",
    "cwes": "",
    "cwesFilter": "",
    "published": "",
    "updated": "",
    "modifiedAfter": "",
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/github-security-advisories-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "ghsaId": "",
    "cveId": "",
    "type": "",
    "severity": "",
    "ecosystem": "",
    "affects": "",
    "cwes": "",
    "cwesFilter": "",
    "published": "",
    "updated": "",
    "modifiedAfter": "",
    "maxItems": 10,
}

# Run the Actor and wait for it to finish
run = client.actor("parseforge/github-security-advisories-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ghsaId": "",
  "cveId": "",
  "type": "",
  "severity": "",
  "ecosystem": "",
  "affects": "",
  "cwes": "",
  "cwesFilter": "",
  "published": "",
  "updated": "",
  "modifiedAfter": "",
  "maxItems": 10
}' |
apify call parseforge/github-security-advisories-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/github-security-advisories-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/bCDNbdIRhb73Qbf2c/builds/SgY49hHvNCHb9hdc0/openapi.json