2026-05-01 17:53 UTC
@davidism I wonder if your experience would meaningfully change if the text for your security policy was checked into the repository.
The ".github" pattern is useful for not having to duplicate everything everywhere, but I wonder how effective that is for generative AI scanning tools which likely aren't pulling the .github repo to discover org-wide security policies and threat models.
Replies (1)
-
@a@fedi.lawngno.me 2026-05-01 18:09
@sethmlarson @davidism Even a link might be sufficient. These scanning tools tend to be very repo-oriented right now. Taking Flask as an example, I'd personally probably get to the security policy via the link to the contribution guide, but smacking people in the face more obviously with a SECURITY.md or update to the README — even if it's just a link — might improve the signal:noise.