diff --git a/README.md b/README.md
index 39ac517..f086a50 100644
--- a/README.md
+++ b/README.md
@@ -277,3 +277,9 @@ agentloop 0.4, 0.5 and 0.6.
 minor release may change the public API.
 
 Licensed under the Apache License 2.0.
+
+## Contributions
+
+This project is open source but does not accept external contributions or pull requests.
+To report a security vulnerability, see the
+[security policy](https://github.com/based-models/agent-loop-tools/security/policy).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..2c1b72e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,14 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately through GitHub: open the
+[Security tab](https://github.com/based-models/agent-loop-tools/security) and choose
+**Report a vulnerability**. Do not post details publicly.
+
+You can expect an acknowledgement, and a fix or an explanation, as time allows. This project is
+maintained by a small team and does not accept external contributions.
+
+## Supported versions
+
+Only the latest release on PyPI receives fixes.
diff --git a/pyproject.toml b/pyproject.toml
index e3cc809..1dc6857 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -28,6 +28,7 @@ dev = ["pytest>=8", "pytest-cov>=5", "mypy>=1.11", "ruff>=0.6", "build>=1.2", "t
 
 [project.urls]
 Repository = "https://github.com/based-models/agent-loop-tools"
+Documentation = "https://www.basedmodels.com/docs/agent-tools"
 
 [build-system]
 requires = ["hatchling"]