Yes. Create a public repository named .github in your organization, add a SECURITY.md to it, and GitHub uses that file for every repository in the organization that has no SECURITY.md of its own. One edit then updates your reporting instructions everywhere.
What a default community health file is
GitHub calls SECURITY.md one of its default community health files. Others include CONTRIBUTING.md, CODE_OF_CONDUCT.md and SUPPORT.md. The defaults live in a repository called .github, owned by the organization or personal account that should use them.
Two details from GitHub's documentation matter here. The .github repository must be public, and a repository for default files cannot be private. The defaults still apply to repositories owned by the account whatever their visibility, as long as the destination repository has no file of that type.
Steps to set it up
- Create a new repository in your organization and name it exactly .github.
- Set its visibility to Public.
- Add a SECURITY.md in the root, in a .github folder, or in a docs folder.
- Write one reporting route that works for every repository (see below).
- Open a repository that has no SECURITY.md of its own, click its Security tab, and confirm the policy shows up.
If you have never written the file itself, our guide to writing a SECURITY.md for an open source repo covers what to put in it.
Which file wins
When a file can sit in more than one place, GitHub documents this order of precedence: the .github folder, then the root of the repository, then the docs folder. If the current repository has none, GitHub falls back to the default from the .github repository, and it applies the same order inside that repository.
| Situation | What GitHub shows |
|---|---|
| Repo has its own SECURITY.md | The repo's own file |
| Repo has none, organization has a .github repo with one | The organization default |
| Neither exists | No security policy |
What belongs in a shared file
A default file has to be true for every repository, so keep it to things that do not vary by project.
- The reporting route: a security mailbox, or a link to private vulnerability reporting. See how to enable GitHub private vulnerability reporting.
- What you will do after a report arrives, in plain terms. Only promise timelines you can meet.
- A pointer to the organization security page or a security.txt file. The two formats serve different readers, as explained in SECURITY.md vs security.txt.
Leave out the supported versions table. Versions differ per project, so a single organization-wide table will be wrong for most repos.
When to override per repository
Add a repository level SECURITY.md when a project has its own supported versions, a different contact, or its own embargo rules. A repo file takes precedence, so you only maintain the exceptions.
One side effect worth knowing: GitHub notes that files in the .github repository do not appear in the file browser or Git history of individual repositories and are not included in their clones, packages or downloads. Someone who clones a repo will not find a SECURITY.md inside it. If your project is redistributed through package registries, consider also shipping a copy in the repo itself.
Try it as a reporter
Open three of your repositories in a private browser window and look for the policy as a stranger would. Does each one lead to a working contact? If a repository shows nothing, the default is not applying, so check that the .github repository is public and named exactly that.
Quick check
Does the default SECURITY.md apply to private repositories?
GitHub's documentation says defaults apply to any repository owned by the account regardless of the destination repository's visibility, provided the repository has no file of that type. The .github repository itself must stay public.
If a repository has its own SECURITY.md, is the organization one ignored?
For that repository, yes. The repository's own file is used first, and the default only fills the gap where there is none.
Is a SECURITY.md enough on its own?
It tells reporters where to go, but someone still has to read the inbox and answer. Name an owner and a backup, or the file becomes a promise nobody keeps.
If you want to know which of your repositories ship vulnerable dependencies while you fix up the policy side, Safeguard offers a free scan at gold.safeguard.sh/scan.
Sources
- GitHub Docs, Creating a default community health file
- GitHub Docs, Adding a security policy to your repository
Last reviewed: 19 October 2026.
