What is the GitHub 'security policy' file (SECURITY.md) and what does it do?
Select an answer to reveal the explanation.
Short Explanation and Infographic
SECURITY.md is your vulnerability disclosure policy file. Put it in the root or .github directory and GitHub surfaces it prominently — it tells security researchers exactly how and where to report a vulnerability they've found, rather than posting it publicly first.
Full explanation below image
Full Explanation
A SECURITY.md file establishes a repository's security vulnerability reporting policy. When present: (1) GitHub displays a 'Report a vulnerability' button on the Security tab and shows the policy file to anyone viewing the repository. (2) The file typically includes: contact information for security reports (email, security advisory form), what information to include in a report, expected response times, the project's supported versions, and what is considered in/out of scope. (3) GitHub makes it easy to create through the Security tab if the file doesn't exist. Security policies help implement responsible disclosure: researchers know the right channel to report, and the project can fix the issue privately before it becomes public knowledge. Without a SECURITY.md, GitHub shows a generic message on the Security tab.