Add SECURITY.md to GitHub Repositories
Add a security policy that tells researchers which versions are supported and how to report vulnerabilities privately. The file provides instructions; it does not automatically enable a private reporting service.
Step-by-step guide
Check access and scope
You need permission to propose repository content and agreement from the team monitoring the reporting channel. Verify the channel is real and maintained.
Confirm the reporting owner
Identify supported versions and the responsible security contact.
Create the policy file
Create SECURITY.md through the policy setup or a repository change. The repository Security policy setup creates SECURITY.md; propose the file through a branch and pull request when changing the default branch.
- Worked example: Ask researchers to describe an invitation-token issue through the monitored private channel and avoid posting live tokens in public issues. Confirm who receives and triages the report before announcing the policy.
Write private instructions
Write private reporting instructions and requested safe evidence.
Agree response expectations
State realistic response expectations without inventing service promises.
Review the reporting path
Review the policy through a pull request and test the reporting path safely.
Verify the result
The repository exposes the policy and a harmless channel check reaches the responsible team.
Common mistakes
Check the handoff edge case
Publishing response promises that the team cannot meet creates false expectations. Use agreed instructions and a maintained ownership process.
Sources and verification
Based on product documentation checked on 2026-10-24. This is a documentation-based guide, not a hands-on benchmark. Features and availability can change.