diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..94e04dc
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities **privately** — do not open a public
+issue or pull request for a suspected vulnerability.
+
+Use GitHub's private vulnerability reporting:
+[**Report a vulnerability**](https://github.com/ProfessionalWiki/SimpleBatchUpload/security/advisories/new).
+
+A helpful report includes:
+
+- The affected component and the commit or branch you tested against
+- Steps to reproduce, ideally with a proof of concept
+- Your assessment of the impact (what an attacker could do)
+
+## Supported Versions
+
+Security fixes are provided for the latest major version of SimpleBatchUpload.
+Please upgrade to the current release before reporting an issue. Fixes ship in a new release rather than as backports to older versions.
+
+## Disclosure
+
+We practice coordinated disclosure. We aim to acknowledge your report within
+five business days, keep you informed of our progress, and credit you when a
+fix is published (unless you prefer to remain anonymous). We will work on a fix
+as quickly as the severity warrants. Please give us a reasonable opportunity to
+release that fix before disclosing the issue publicly.