In GitHub, what is a 'Security policy' (SECURITY.md file) and what is its purpose?
Select an answer to reveal the explanation.
Short Explanation and Infographic
SECURITY.md is your responsible disclosure instruction manual. It tells security researchers: 'Found a bug? Here's the right way to tell us about it privately.' Without it, researchers might just post vulnerabilities publicly.
Full explanation below image
Full Explanation
A SECURITY.md file is a repository or organization-level file that documents the security vulnerability disclosure process for a project. When present (placed in the root, docs/, or .github/ directory), it: (1) Appears as a 'Report a vulnerability' button on the repository's Security tab. (2) Tells security researchers how to responsibly disclose vulnerabilities (email address, disclosure timeline, what information to include). (3) Sets expectations for response time and handling. GitHub displays a notice on the Advisories page if no SECURITY.md is found. Organizations can create a .github repository with an organization-level SECURITY.md that applies to all org repositories lacking their own. SECURITY.md is NOT a configuration file for security tooling — it's a human-readable document.