Check ID:
Provider: GitHub
Service:
Severity: LOW
Categories:
Resource type:
repository_public_has_securitymd_fileProvider: GitHub
Service:
repositorySeverity: LOW
Categories:
software-supply-chainResource type:
NotDefinedWhat this check verifies
GitHub public repository include aSECURITY.md policy file that tells researchers how to report vulnerabilities. The evaluation focuses on the presence of this file in public repositories.
Risk
Without SECURITY.md, reporters may use public issues or ad-hoc channels, causing premature disclosure or missed reports. This widens the exploit window and impacts confidentiality (leaked details), integrity (unauthorized changes), and availability (DoS from unpatched flaws).Recommendation
Publish a clearSECURITY.md for each public repo or an org default. Include private reporting channels, optional encryption keys, scope/supported versions, disclosure timelines, and safe-harbor terms. Link to any bounty program and review regularly. Align with accountability and defense in depth principles.
Remediation
- CLI
- Terraform
- Dashboard steps
References
- https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
- https://github.blog/changelog/2019-05-23-security-policy/
Where this check fires
This check runs on every scheduled scan against your GitHub account. Findings appear at Cloud Security → Findings filterable byCheck ID = repository_public_has_securitymd_file. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GitHub checks