Awarded for completing Publishing Your Own Security Advisory and passing its exam, demonstrating the ability to decide whether a vulnerability warrants public disclosure, obtain and maintain an identifier, write affected versions and defender guidance that can be acted on, assign and defend a severity assessment, coordinate timing with reporters and downstream parties, and publish a machine readable record that consumers can automate.
Certificates are designed to be checked, not just displayed.
The credential is valid for 12 months from issue. Its public page states the expiry date, and renewing means passing the current exam again — so the credential always reflects the current material.
