diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f4e967b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest published version receives security fixes.
+
+## Reporting a vulnerability
+
+Please use GitHub's private vulnerability reporting for this repository. Do not
+disclose vulnerabilities through public issues, pull requests, or discussions.
+Include the affected version, reproduction steps, and impact so the issue can be
+assessed and addressed safely.