What details should you include in your security policy?

The correct answer is C. how to report a vulnerability. A security policy (SECURITY.md) should clearly explain how to report a vulnerability - including the preferred contact method (e.g., private email, GitHub's private vulnerability reporting), what information to include in the report, the expected response timeline, and the…

Best Practices and Remediation

Question

Options

Athe reported issue for the security vulnerability
Bthe previous commit version to the current branch
Chow to report a vulnerability
Dthe standards for how to engage with a community

How the community answered

(22 responses)

C
95% (21)
D
5% (1)

Explanation

A security policy (SECURITY.md) should clearly explain how to report a vulnerability - including the preferred contact method (e.g., private email, GitHub's private vulnerability reporting), what information to include in the report, the expected response timeline, and the coordinated disclosure process. This gives security researchers and contributors a clear, safe path to notify maintainers without accidentally making the vulnerability public. Option A (reported issue details) is what a reporter provides to you, not what the policy defines. Option B (previous commit version) is irrelevant to a security policy. Option D (community engagement standards) belongs in CONTRIBUTING.md or a Code of Conduct, not a security policy.

Topics

#Security Policy#Vulnerability Reporting#Responsible Disclosure#Security Best Practices

Community Discussion

No community discussion yet for this question.

Full GH-500 Practice