Agent WranglersOSS-47Recommended
Publish a security policy with the code
Put a SECURITY.md in every repository that others use or deploy. Name the supported versions, a private way to report, and the reply time.
How to do it
Someone who finds a hole needs a private channel, not a public issue that shows attackers the way in. Set up that channel and its contacts as Send private reports to at least two people says. State the reply time, such as 3 working days, and which versions get fixes. A website also points its security.txt at the same policy. A product under the EU Cyber Resilience Act needs this policy, as Handle vulnerabilities for the whole support period explains.
Examples
Markdown example
# Security policy
## Supported versions
Version 2.x gets security fixes. Version 1.x stopped on 30 June 2026.
## Reporting a vulnerability
Use "Report a vulnerability" on the Security tab, or write to security@example.com.
We reply within 3 working days and tell you when the fix ships.How to check
Each repository has a SECURITY.md with a supported versions section and a reporting section. gh api repos/example/shop/private-vulnerability-reporting --jq .enabled prints true, or the file names a security address. A test report each quarter gets a reply within the stated time.
Sources
Related rules
- DOC-11 Keep a docs version for every supported release in Documentation
- DOC-39 Ship the user information the Cyber Resilience Act lists in Documentation
- SUP-22 Route security reports and legal notices to their owners the same day in Customer support
- IOT-38 Publish how to report a vulnerability in your device in Connected devices
- OSS-22 Send private reports to at least two people in Open source maintenance
- WEB-143 Tell people how to report a hole in Website
- CMP-50 Handle vulnerabilities for the whole support period in Compliance and governance
- OSS-28 Publish a cybersecurity policy as an open source steward in Open source maintenance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy">Agent Wranglers open source maintenance playbook</a>. In code you write, add a comment next to it with the same link.