SECURITY.md

[damn-am-star]

Why:

Closes:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

• A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR. In most cases, the author can be the SME. Open source contributions may require an SME review from GitHub staff.
• The changes in this PR meet the docs fundamentals that are required for all content.
• All CI checks are passing and the changes look good in the review environment.

[welcome]

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[github-actions]

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

• Spin up a codespace
• Set up a local development environment

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

This pull request contains code changes, so we will not generate a table of review links.

🤖 This comment is automatically generated.

[docs-bot]

👋 Hi there! It looks like you've modified some files that we can't accept as contributions:

• rex
• src/README.md

You'll need to raise a new PR that doesn't include those files, before we can review.

The complete list of files we can't accept are:

• Anything in the root directory
• .devcontainer/**
• .github/**
• data/reusables/rai/**
• .vscode/**
• config/**
• contributing/**
• src/**
• patches/**
• content/actions/how-tos/secure-your-work/security-harden-deployments/**
• content/README.md

We also can't accept contributions to files in the content directory with frontmatter contentType: rai. You can always check out our full contribution guidelines.

[Copilot]

🟡 Changes recommended

It omits the advertised security policy, modifies protected DCO text, and breaks existing contributor documentation.

2 open findings

• Add the vulnerability policy as SECURITY.md · New
• Correct “heating” to “heading” in all examples · New

What changed in this PR

This PR appears intended to add a security policy, but no SECURITY.md is included.

Changes:

• Adds a modified Developer Certificate of Origin.
• Adds heading examples.
• Deletes contributor architecture documentation.

File	Description
tor/​Web	Adds a modified DCO instead of a security policy.
src/​README.md	Removes subject-folder guidance.
rex	Adds heading examples containing typos.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.