Part of the OSSF Scorecard score is the presence and content of a security policy. Traditionally that's a SECURITY.md file in the top level of the repository.

Here are a few security policies for PESO member projects to use as a starting place:

• https://github.com/HDFGroup/hdf5/blob/develop/SECURITY.md
• https://github.com/ornladios/ADIOS2/blob/master/SECURITY.md
• https://github.com/visit-dav/visit/blob/develop/SECURITY.md