diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..43a7fd1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues,
+pull requests, or discussions.
+
+Contact a repository maintainer directly (see the maintainers listed on the
+[hivecommons organization](https://github.com/hivecommons)) with:
+
+- The affected component and the commit or published npm version.
+- A description of the issue and its potential impact.
+- Steps to reproduce, with any proof-of-concept or logs.
+
+## What to Expect
+
+We aim to acknowledge reports within 5 business days, investigate, and
+coordinate a fix and disclosure timeline with you. Please allow a reasonable
+time to remediate before public disclosure.