# Adding a security policy to your repository
You can give instructions for how to report a security vulnerability in your project by adding a security policy to your repository.
1. On GitHub, navigate to the main page of the repository.
2. Under the repository name, click the ** Security and quality** tab. If you cannot see the " Security and quality" tab, select the **** dropdown menu, and then click ** Security and quality**.
3. In the left sidebar, under "Reporting", click ** Policy**.
4. Click **Start setup**.
5. In the new `SECURITY.md` file, add information about supported versions of your project and how to report a vulnerability.
6. Click **Commit changes...**
7. In the "Commit message" field, type a short, meaningful commit message that describes the change you made to the file. You can attribute the commit to more than one author in the commit message. For more information, see [Creating a commit with multiple authors](/en/pull-requests/committing-changes-to-your-project/creating-and-editing-commits/creating-a-commit-with-multiple-authors).
8. If you have more than one email address associated with your account on GitHub, click the email address drop-down menu and select the email address to use as the Git author email address. Only verified email addresses appear in this drop-down menu. If you enabled email address privacy, then a no-reply will be the default commit author email address. For more information about the exact form the no-reply email address can take, see [Setting your commit email address](/en/account-and-profile/setting-up-and-managing-your-personal-account-on-github/managing-email-preferences/setting-your-commit-email-address).
9. Below the commit message fields, decide whether to add your commit to the current branch or to a new branch. If your current branch is the default branch, you should choose to create a new branch for your commit and then create a pull request. For more information, see [Creating a pull request](/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request).
10. Click **Commit changes** or **Propose changes**.
## Further reading
* [Creating a default community health file](/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file)
* [Quickstart for securing your repository](/en/code-security/getting-started/securing-your-repository)
* [Setting up your project for healthy contributions](/en/communities/setting-up-your-project-for-healthy-contributions)
* [GitHub Security Lab](https://securitylab.github.com/)