Security Insights is a single YAML file in which a project reports its security practices in a standard, machine-readable format. It fills the gap between a plain-text SECURITY.md and an SBOM, holding security facts only maintainers can report. Consumers look for security-insights.yml or .yaml at the repository root or in the source-forge directory. An OpenSSF project; the latest release is v2.2.0 (31 January 2026). Specification text is under the Community Specification License 1.0.
OpenSSF Security Insights
Security Insights is where a project writes down its security posture in a form tools can read. Where
SECURITY.md tells a person how to report a vulnerability, security-insights.yml reports the project’s
security practices as structured data that automated tools parse consistently.
- One file, known places - Consumers look for
security-insights.yamlor.ymlat the repository root or in a source-forge directory such as.github/; if both extensions exist in one place, that is an error. - A snapshot - The file describes the commit or release it ships with, not necessarily the project’s current state.
- Single- and multi-repo - Examples cover a minimal file, a full file, and a multi-repository layout in
which child repositories reference a parent
project:section. - Read by Linux Foundation tooling - CLOMonitor parses the file, and LFX Insights uses it to evaluate projects against the OSPS Baseline.
- Versioned schema - v1.0.0 (October 2023), v2.0.0 (January 2025), v2.1.0 (May 2025), v2.2.0 (January 2026). Spec text CSL-1.0; included code MIT unless designated otherwise.
Where it sits. Security Insights is the structured companion to SECURITY.md and sits beside the supply-chain artifacts it does not replace: SBOMs in SPDX or CycloneDX, build provenance under SLSA, and vulnerability statements in OpenVEX or OSV.
