diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..c54cc0c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are provided for the latest version of each csi-rs project.
+
+## Reporting a vulnerability
+
+Do not report security vulnerabilities through public GitHub issues.
+
+Report a vulnerability privately through GitHub's private vulnerability
+reporting feature. Include:
+
+- a description of the vulnerability,
+- steps to reproduce it,
+- the affected version or commit,
+- its potential impact,
+- and any known mitigation.
+
+The maintainers will review the report and respond when more information or
+a fix is available.