How to add a SECURITY.md security policy to a repository
Why it matters
Without a stated way to report a vulnerability privately, researchers open a public issue — and the details are out before a fix exists. GitHub shows SECURITY.md in the Security tab.
How to fix it
What to do: Create
SECURITY.md with a responsible disclosure policy.# Security Policy
## Supported Versions
| Version | Supported |
| ------- | --------- |
| 1.x | ✓ |
## Reporting a Vulnerability
Please do NOT open a public issue.
Email: security@yourproject.com
We respond within 48 hours.
After a fix, we publish a CVE and credit you (if desired).
Does your repository pass this check?
Free for public GitHub repositories, no account needed. 50+ DevOps and security checks in about ten seconds.