diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b46cdc3..5220691 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,5 +1,7 @@
 # Contributing
 
+Follow the [security policy](SECURITY.md) to report vulnerabilities privately.
+
 Install mise. Run these commands from the repository root.
 
 ```sh
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..dec6cda
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security policy
+
+## Supported versions
+
+Security fixes support the latest release and the main branch.
+Earlier releases are not supported.
+
+## Report a vulnerability
+
+Report vulnerabilities privately through GitHub private vulnerability reporting.
+Open the repository's [Security tab](https://github.com/armada877/syn-cli/security).
+Select **Report a vulnerability** and submit your report.
+Do not open public issues for vulnerabilities.
+
+Include these details in your report:
+
+- The affected release or commit.
+- Your operating system and relevant configuration.
+- A description of the vulnerability and its possible impact.
+- Steps to reproduce the problem.
+- A small example or proof of concept, if available.
+- A possible fix, if known.
+
+Remove passwords, tokens, and other private data from examples and logs.
+
+The maintainer will reply as soon as possible.
+There is no fixed response time.