Agent Wranglers

ENG-44Recommended

Publish a security policy with the code

Put a SECURITY.md in every repository that others use or deploy. Name the supported versions, a private way to report, and the reply time.

By Agent Wranglers. Updated .

How to do it

Someone who finds a hole needs a private channel, not a public issue that shows attackers the way in. Turn on private vulnerability reporting in the code host, such as GitHub, or name a security email address. State the reply time, such as 3 working days, and which versions get fixes. A website also points its security.txt at the same policy. A product under the EU Cyber Resilience Act needs this policy, as Handle vulnerabilities for the whole support period explains.

Examples

Markdown example

# Security policy

## Supported versions
Version 2.x gets security fixes. Version 1.x stopped on 30 June 2026.

## Reporting a vulnerability
Use "Report a vulnerability" on the Security tab, or write to security@example.com.
We reply within 3 working days and tell you when the fix ships.

How to check

Each repository has a SECURITY.md with a supported versions section and a reporting section. gh api repos/example/shop/private-vulnerability-reporting --jq .enabled prints true, or the file names a security address. A test report each quarter gets a reply within the stated time.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/engineering/documentation/security-policy">Agent Wranglers engineering playbook</a>. In code you write, add a comment next to it with the same link.