diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md
index 84bd3ebe294406..4ddbe4be9ab50d 100644
--- a/doc/contributing/security-release-process.md
+++ b/doc/contributing/security-release-process.md
@@ -67,6 +67,8 @@ The current security stewards are documented in the main Node.js
 * [ ] 3\. **Assigning Severity and Writing Team Summary:**
   * [ ] Assign a severity and write a team summary on HackerOne for the reports
     chosen in the `vulnerabilities.json`.
+  * [ ] If a report targets a Node.js dependency, such as `undici` or `llhttp`,
+    make sure to update the `DEPENDENCY` custom field on HackerOne.
   * Run `git node security --sync` to update severity and summary in
     `vulnerabilities.json`.