diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..1dd7ed990
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you find a security vulnerability, please do not file a public GitHub
+issue. Please report this to security@corsobackup.io. In most cases, we
+will respond within 48 hours or less.