GH-500 · Question #76
As a contributor, you discovered a vulnerability in a repository. Where should you look for the instructions on how to report the vulnerability?
The correct answer is C. security.md. The SECURITY.md file is the GitHub-recognized standard location for a project's security policy, which includes instructions on how to responsibly disclose vulnerabilities. GitHub even surfaces a 'Report a vulnerability' button on repositories that have a SECURITY.md, directing…
Question
As a contributor, you discovered a vulnerability in a repository. Where should you look for the instructions on how to report the vulnerability?
Options
- Acontributing.md
- Breadme.md
- Csecurity.md
- Dsupport.md
How the community answered
(28 responses)- A4% (1)
- B7% (2)
- C89% (25)
Explanation
The SECURITY.md file is the GitHub-recognized standard location for a project's security policy, which includes instructions on how to responsibly disclose vulnerabilities. GitHub even surfaces a 'Report a vulnerability' button on repositories that have a SECURITY.md, directing reporters to follow the documented process. CONTRIBUTING.md (option A) covers general contribution guidelines like code style and pull request processes. README.md (option B) is a general project overview. SUPPORT.md (option D) typically addresses where to get help with using the software (e.g., forums, issue trackers), not how to report security issues. Always check SECURITY.md first for vulnerability disclosure instructions.
Topics
Community Discussion
No community discussion yet for this question.