Builder safety
Builder safety is the record of security warnings for the code that builders use. A security advisory is a public warning about a hole in a piece of software. GitHub keeps the list and rates each one. The Reef records every day's changes on Flare, so anyone can check what was known and when.

Security advisories (GitHub reviewed)
11 days on record · Latest Nov 9, 2026
https://flarereef.flareforward.com/p/20
Since October 30, 2026: 114 new warnings recorded. GitHub rated 24 of them critical.
The ratings are GitHub's own. The Reef adds no score.
November 9, 2026: 45 new, 23 changed, 0 withdrawn. GitHub rated 6 of the new ones critical and 20 high.
Named: fastapi-code-generator, github[.]com/pocket-id/pocket-id/backend, gpustack, github[.]com/kubeflow/pipelines, loggingredactor and 47 more
Permanent record: https://flarereef.flareforward.com/n/452
November 8, 2026: no changes that day.
Permanent record: https://flarereef.flareforward.com/n/447
November 7, 2026: 0 new, 2 changed, 0 withdrawn. GitHub rated 0 of the new ones critical and 0 high.
Named: misp-modules, paramiko
Permanent record: https://flarereef.flareforward.com/n/443
November 6, 2026: 18 new, 6 changed, 0 withdrawn. GitHub rated 6 of the new ones critical and 4 high.
Named: github[.]com/canonical/lxd, github[.]com/osac-project/osac-operator, GeoNode, Magick[.]NET-Q16-AnyCPU, org[.]eclipse[.]hawkbit:hawkbit-ddi-resource and 23 more
Permanent record: https://flarereef.flareforward.com/n/439
November 5, 2026: 10 new, 30 changed, 0 withdrawn. GitHub rated 3 of the new ones critical and 4 high.
Named: urwid, flowise, github[.]com/chainguard-dev/kaniko, org[.]apache[.]activemq:apache-activemq, org[.]apache[.]activemq:activemq-all and 23 more
Permanent record: https://flarereef.flareforward.com/n/434
November 4, 2026: 17 new, 46 changed, 0 withdrawn. GitHub rated 1 of the new ones critical and 9 high.
Named: org[.]apache[.]tomcat[.]embed:tomcat-embed-core, org[.]apache[.]tomcat:tomcat, org[.]apache[.]tomcat:tomcat-util-scan, org[.]apache[.]activemq:activemq-broker, org[.]apache[.]activemq:apache-activemq and 62 more
Permanent record: https://flarereef.flareforward.com/n/430
November 3, 2026: 22 new, 29 changed, 1 withdrawn. GitHub rated 8 of the new ones critical and 9 high.
Named: flowise, enspirit/elo, prefect, org[.]apache[.]iotdb:iotdb-server, Metalama[.]Framework and 132 more
Permanent record: https://flarereef.flareforward.com/n/418
November 2, 2026: 2 new, 16 changed, 0 withdrawn. GitHub rated 0 of the new ones critical and 1 high.
Named: sd-jwt/decode, sd-jwt/core, bytebase/dbhub, facturascripts/facturascripts, parse-server and 11 more
Permanent record: https://flarereef.flareforward.com/n/357
November 1, 2026: no changes that day.
Permanent record: https://flarereef.flareforward.com/n/262
October 31, 2026: no changes that day.
Permanent record: https://flarereef.flareforward.com/n/212
October 30, 2026: no changes that day.
Permanent record: https://flarereef.flareforward.com/n/209