Back to Checks
github

Public repository has a SECURITY.md file

repository_public_has_securitymd_file
Service: repositorySeverity: low
OfficialBuilt-inVerified
Categories:software-supply-chain
Resource Type:NotDefined

GitHub public repository include a SECURITY.md policy file that tells researchers how to report vulnerabilities. The evaluation focuses on the presence of this file in public repositories.

Prowler logoProwlerprowler-provider-github

Risk

Without SECURITY.md, reporters may use public issues or ad-hoc channels, causing premature disclosure or missed reports. This widens the exploit window and impacts confidentiality (leaked details), integrity (unauthorized changes), and availability (DoS from unpatched flaws).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler github --checks repository_public_has_securitymd_file

Recommendation

Publish a clear SECURITY.md for each public repo or an org default. Include private reporting channels, optional encryption keys, scope/supported versions, disclosure timelines, and safe-harbor terms. Link to any bounty program and review regularly. Align with accountability and defense in depth principles.

Remediation

CLI

gh api -X PUT repos/<OWNER>/<REPO>/contents/.github/SECURITY.md -f message='Add SECURITY.md' -f content='UmVwb3J0IHZ1bG5lcmFiaWxpdGllcyB0byBzZWN1cml0eUBleGFtcGxlLmNvbQo='

Terraform

resource "github_repository_file" "security_md" {
  repository = "<example_resource_name>"
  file       = ".github/SECURITY.md"  # Critical: ensures SECURITY.md exists in a recognized location
  content    = "Report vulnerabilities to security@example.com"  # Critical: creates the file so the check passes
}

Other

1In GitHub, open the target repository
2Click Security > Policy (under Reporting)
3Click Start setup
4Add minimal instructions (e.g., how to report vulnerabilities)
5Click Commit changes to create SECURITY.md

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportGithub
from prowler.providers.github.services.repository.repository_client import (
    repository_client,
)


class repository_public_has_securitymd_file(Check):
    """Check if a public repository has a SECURITY.md file

    This class verifies whether each public repository has a SECURITY.md file.
    """

    def execute(self) -> List[CheckReportGithub]:
        """Execute the Github Repository Public Has SECURITY.md File check

        Iterates over all public repositories and checks if they have a SECURITY.md file.

        Returns:
            List[CheckReportGithub]: A list of reports for each repository
        """
        findings = []
        for repo in repository_client.repositories.values():
            if not repo.private and repo.securitymd is not None:
                report = CheckReportGithub(metadata=self.metadata(), resource=repo)
                report.status = "PASS"
                report.status_extended = (
                    f"Repository {repo.name} does have a SECURITY.md file."
                )

                if not repo.securitymd:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Repository {repo.name} does not have a SECURITY.md file."
                    )

                findings.append(report)

        return findings

References