--- title: "Publish a security policy with the code ยท Agent Wranglers" url: https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-policy id: OSS-47 level: Recommended updated: 2026-10-27 build: a2a6bdfed830 tokens: 1146 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Publish a security policy with the code For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Vulnerabilities and advisories](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: OSS-47 - Level: Recommended - Chapter: [Vulnerabilities and advisories](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories.md) - Rule: Put a `SECURITY.md` in every repository that others use or deploy. Name the supported versions, a private way to report, and the reply time. - Check: Each repository has a `SECURITY.md` with a supported versions section and a reporting section. `gh api repos/example/shop/private-vulnerability-reporting --jq .enabled` prints `true`, or the file names a security address. A test report each quarter gets a reply within the stated time. - How: Someone who finds a hole needs a private channel, not a public issue that shows attackers the way in. Set up that channel and its contacts as [Send private reports to at least two people](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts.md) says. State the reply time, such as 3 working days, and which versions get fixes. A website also points its [security.txt](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) at the same policy. A product under the EU Cyber Resilience Act needs this policy, as [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) explains. ## Examples **Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses. ### Markdown example ```markdown # Security policy ## Supported versions Version 2.x gets security fixes. Version 1.x stopped on 30 June 2026. ## Reporting a vulnerability Use "Report a vulnerability" on the Security tab, or write to security@example.com. We reply within 3 working days and tell you when the fix ships. ``` ## Sources - [GitHub: Adding a security policy to your repository](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) ## Related rules - DOC-11 [Keep a docs version for every supported release](https://agentwranglers.se/playbook/documentation/reference-and-changelogs/versioned-docs.md) in Documentation - DOC-39 [Ship the user information the Cyber Resilience Act lists](https://agentwranglers.se/playbook/documentation/help-centres-and-user-guides/cra-user-information.md) in Documentation - SUP-22 [Route security reports and legal notices to their owners the same day](https://agentwranglers.se/playbook/customer-support/response-times-and-escalation/security-and-legal-routing.md) in Customer support - IOT-38 [Publish how to report a vulnerability in your device](https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/device-disclosure-policy.md) in Connected devices - OSS-22 [Send private reports to at least two people](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts.md) in Open source maintenance - WEB-143 [Tell people how to report a hole](https://agentwranglers.se/playbook/website/standard-addresses/security-txt.md) in Website - CMP-50 [Handle vulnerabilities for the whole support period](https://agentwranglers.se/playbook/compliance/security-laws/cra-support-period.md) in Compliance and governance - OSS-28 [Publish a cybersecurity policy as an open source steward](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/steward-security-policy.md) in Open source maintenance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers open source maintenance playbook`. In code you write, add a comment next to it with the same link. - Next: [Send private reports to at least two people](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories/security-contacts.md) - [Vulnerabilities and advisories](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories.md)