---
title: "Publish a security policy with the code · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/documentation/security-policy
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Publish a security policy with the code

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Documentation](https://agentwranglers.se/playbook/engineering/documentation.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: ENG-44
- Level: Recommended
- Chapter: [Documentation](https://agentwranglers.se/playbook/engineering/documentation)
- Rule: Put a `SECURITY.md` in every repository that others use or deploy. Name the supported versions, a private way to report, and the reply time.
- How: Someone who finds a hole needs a private channel, not a public issue that shows attackers the way in. Turn on private vulnerability reporting in the code host, such as GitHub, or name a security email address. State the reply time, such as 3 working days, and which versions get fixes. A website also points its [security.txt](https://agentwranglers.se/playbook/website/security/security-txt) at the same policy. A product under the EU Cyber Resilience Act needs this policy, as [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period) explains.
- Check: Each repository has a `SECURITY.md` with a supported versions section and a reporting section. `gh api repos/example/shop/private-vulnerability-reporting --jq .enabled` prints `true`, or the file names a security address. A test report each quarter gets a reply within the stated time.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Markdown example

```markdown
# Security policy

## Supported versions
Version 2.x gets security fixes. Version 1.x stopped on 30 June 2026.

## Reporting a vulnerability
Use "Report a vulnerability" on the Security tab, or write to security@example.com.
We reply within 3 working days and tell you when the fix ships.
```

## Sources

- [GitHub: Adding a security policy to your repository](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)

## Related rules

- [Tell people how to report a hole](https://agentwranglers.se/playbook/website/security/security-txt) in Website
- [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/product-and-sector-laws/cra-support-period) in Compliance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/engineering/documentation/security-policy">Agent Wranglers engineering playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Let an agent reread rules whose sources changed](https://agentwranglers.se/playbook/engineering/documentation/recheck-sources-with-an-agent)
- [Documentation](https://agentwranglers.se/playbook/engineering/documentation)