diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..18358e55
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security issue with REDAXO or a related package, please contact us
+via `info {at} redaxo.org` instead of using a public channel. That way we can work on
+a fix together before everyone knows how to exploit a potential issue. Thank you!