diff --git a/README.md b/README.md
index 163e60b..146f8e4 100644
--- a/README.md
+++ b/README.md
@@ -137,3 +137,7 @@ development of VSS, you can reach out to us in the [LDK Discord] in the `#vss` c
 [LDK Discord]: https://discord.gg/5AcknnMfBw
 
 [UniFFI]: https://mozilla.github.io/uniffi-rs/
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for vulnerability reporting.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..5ce5072
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+Please prefer the latest release when reporting security issues.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately:
+
+1. Open a GitHub Security Advisory for this repository when available, or
+2. Contact the maintainers via the email listed in the repository profile or README.
+
+Please include steps to reproduce, impact, and any suggested fix.
+Do not open a public issue for sensitive reports.