⌘ K
supported versions · disclosure · SLA

Generate a SECURITY.md policy

Describe your project's supported versions, how to report a vulnerability, and your disclosure window. GitHub surfaces it as the Report a Vulnerability link.

SECURITY.md Generator
Markdown
740 B
30 lines
Versions
2
supported
SLA
48 hours
ack
Disclosure
90d
coord window
Path: SECURITY.md (repo root or .github/)
input · fields
output · SECURITY.md
# Security Policy

## Supported Versions

The following versions of **My Project** receive security updates.

| Version | Supported          |
| ------- | ------------------ |
| 1.x   | :white_check_mark: |
| 0.9.x   | :x: |

## Reporting a Vulnerability

If you discover a security issue in **My Project**, **please do not open a public GitHub issue.**

Instead, email **security@example.com** with:

- A description of the issue
- Steps to reproduce
- The version(s) affected
- Any proof-of-concept code (if available)

You can expect:

- An acknowledgement within **48 hours**
- An initial assessment within 7 days
- Coordinated disclosure within **90 days** of confirmation

Thanks for helping keep **My Project** and its users secure.
Quick Start

How to publish a security policy

Save the file at SECURITY.md in the repo root (or .github/) and push.

  1. 01

    Set basics

    Project name and a private security inbox — not a public bug tracker.

    Parsing runs through marked with GFM extensions enabled — tables, task lists, strikethrough, and fenced code blocks all match GitHub’s rendering.

    basicsGFMmarkedCommonMarklive
    set · markdownok · GFM
    security@…
    loaded · GFMGFM · ready
  2. 02

    List versions

    One per line. The first row is marked supported; the rest are flagged unsupported.

    Soft-break behaviour is configurable: by default a single newline becomes a space (CommonMark), toggle on for chat-style <br> insertion.

    versionssoft-breaksoptionsconfiglive
    versions · options2 · live
    | 1.x | ✓ |
    options applied · livelive
  3. 03

    Set timings

    SLA for acknowledgement, days for coordinated disclosure.

    The preview is scoped under a .mde class so its CSS doesn’t bleed into the rest of the page. Output HTML is whitespace-controlled for clean diffs.

    slapreviewscoped CSSrenderstable
    ack · rendered48 hours · ready
    48 hours ack
    rendered · liverendered
  4. 04

    Publish

    GitHub surfaces SECURITY.md as the Report a vulnerability link.

    Export covers both raw Markdown and rendered HTML; downloads stream as text/markdown or text/html via Blob + object URL.

    publishclipboard.md.htmlblob
    ✓ · exportedlive · done
    ✓ Copied
    shipped · ready to shipsuccess
Pro tips

Author Markdown that renders everywhere

GFM is the safe default

GitHub-Flavored Markdown is the de-facto baseline (tables, task lists, strikethrough). CommonMark is stricter but ubiquitous as a fallback.

Soft-break behaviour varies

A single newline is a space in CommonMark, a <br> in GFM. Toggle soft breaks when source matters.

Escape inside code fences

Backticks inside fenced blocks need a longer fence — three becomes four. Use ~~~ if your content has many backticks.

Anchors are slugified

GitHub lowercases, strips punctuation, and joins with hyphens. Duplicate headings get -1, -2 suffixes.

Tables need a header row

The dash row sets alignment (:---, :-:, ---:). Use Table Aligner for diff-friendly columns.

Front matter is YAML

Triple-dash blocks at the top of files are parsed by static-site generators. Use the Front-Matter Validator to catch syntax errors.

Related toolsCONTRIBUTING.mdCoCREADMEFUNDING.ymlPR TemplateIssue Template
Use Cases

When you need a SECURITY.md

Any project shipping to others.

OSS libs

Give researchers a clear, private path for disclosure. Render path uses marked with GFM extensions enabled (tables, task lists, strikethrough, autolinks), so what you preview matches what GitHub publishes bit-for-bit. Soft-break behaviour is configurable for chat-style vs prose Markdown.

GFM-compliant

SaaS

Pair with a public bug bounty program. Pairs cleanly with the Markdown Cheatsheet for syntax you can't quite remember — callout blocks, footnotes, definition lists. Output stays diff-friendly so style-only changes don't drown out real edits in PRs.

GitHub-perfect

Compliance

SOC2 / ISO requires a published vulnerability policy. Cross-platform safe: anchors, code fences, and tables behave identically on GitHub, GitLab, Bitbucket, and Gitea. Heading-anchor slugs follow GitHub's lowercase-and-hyphenate rules so deep links survive a docs migration.

diff-friendly

Enterprise

Customers verify security posture before adoption. No server roundtrip — perfect for proprietary content you can't paste into a public tool. The full marked + GFM bundle ships with the page, so it works offline once loaded.

render-stable

LTS branches

Document which versions still get security patches. Front matter (YAML / TOML / JSON) passes through unchanged so static-site pipelines (Jekyll, Hugo, Astro, Eleventy) read it correctly. Pair with the Front-Matter Validator to catch syntax errors before deploy.

cross-platform

Reduce noise

Push reports out of public issues into a triaged inbox. Output is reproducible: identical input always produces identical Markdown, so doc-generation scripts can rely on it for snapshot tests and embedded into release workflows.

SEO-friendly
FAQ

Frequently asked questions

SECURITY.md in the repo root, docs/, or .github/. GitHub auto-detects any of these.
Enable PVR in GitHub repo settings — SECURITY.md is the public-facing description.
Mention your CNA or that you assign CVEs via GitHub's Security Advisories feature.
Add each on its own line — only the first row shows as supported in the table; tweak the output as needed.
No. The Markdown is generated locally.
Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

Sent straight to the maintainers · no account needed
47 in queue·8 shipped this month
Request queued. Thanks!