What is SECURITY.md?

• A. It is a license file.
• B. The primary document for communicating security information, and must be at repo root.
• C. A changelog for security patches.
• D. A configuration file for CI.

Answer: (B)

Security.md is the repository’s security policy—the primary place that explains how to report vulnerabilities, who to contact, and what response process and timelines the project follows. It helps ensure responsible disclosure and provides clarity on how the project handles security issues, often including what counts as a security issue and what to expect after you report one. It should be located at the repository root so it’s easy to find and, on GitHub, is surfaced through the Security tab. It isn’t a license file, a changelog, or a CI configuration file.