Why would someone choose to configure a security policy?

Question

Options

• ATo communicate corporate security and compliance policies for end users on a private repository.
• BTo provide information on an open source repository for open source collaborators and
• CTo prevent anyone from pushing to the repository without approval.
• DTo define which open source packages are permitted for use as part of that repository.

• B
  90% (26)
• C
  7% (2)
• D
  3% (1)

Explanation

Option B is correct because a security policy (typically a SECURITY.md file) exists to inform open source contributors and collaborators how to responsibly disclose vulnerabilities, which versions are supported, and how to engage with the project's security practices - making it primarily a communication tool for public, open source repositories.

Why the distractors are wrong:

• A is wrong because a security policy targets open source collaborators on public repos, not end users on private repositories - internal corporate compliance uses different mechanisms (wikis, access controls, HR policies).
• C describes branch protection rules, not a security policy - push restrictions and required approvals are configured separately under branch settings.
• D describes a dependency/license policy or software composition analysis (SCA) configuration - defining permitted packages is a supply chain concern, not what a security policy file addresses.

Memory tip: Think of the acronym SECURITY.md = "Someone Externally Can Understand Responsible Investigative Techniques for Your project" - it's a public-facing guide for external contributors to report vulnerabilities, not an internal enforcement tool.

No community discussion yet for this question.