diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..ed93762
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released for the latest major version only.
+
+| Version | Supported |
+| ------- | --------- |
+| 7.x     | Yes       |
+| < 7.0   | No        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues, pull requests, or discussions.
+
+Instead, report them privately through GitHub's [private vulnerability reporting](https://github.com/yahoo/serialize-javascript/security/advisories/new). This opens a draft security advisory that only the maintainers can see, where we can discuss the issue with you, develop a fix, and coordinate disclosure.
+
+Please include:
+
+- The affected version(s)
+- A minimal reproduction (input, options, and the resulting output)
+- The context the output is used in (e.g. embedded in an HTML `<script>` element)
+- The impact you believe it has
+
+We will acknowledge your report as soon as we can, keep you updated on progress, and credit you in the published advisory unless you prefer otherwise.
+
+## Scope
+
+`serialize-javascript` escapes its output so it can be safely embedded in an HTML `<script>` element (unless `options.unsafe` is set). Reports that untrusted **data** (strings, object keys, regexps, dates, etc.) can break out of that context are in scope.
+
+Serializing a **function** emits its source text as code. If an attacker can control the source text of a function you serialize, they can already run code in your page, so that is not a vulnerability by itself. We still treat a function body that escapes the `<script>` element (for example, injecting HTML markup) as a defect and fix it, but it is considered low severity.