diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f6ef386
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report suspected security vulnerabilities privately rather than opening a public issue.
+
+Include:
+- affected component or version;
+- reproduction steps or a minimal proof of concept;
+- security impact;
+- relevant logs or samples that can be shared safely.
+
+Do not disclose credentials, API keys, personal data, or other sensitive material in public issues.
+
+## Scope
+
+This project is intended for defensive security research and authorized testing. Findings involving third-party systems should be reported to the affected project or vendor through its responsible-disclosure process.
+
+## Disclosure
+
+Coordinated disclosure is preferred. Please allow reasonable time for investigation and remediation before public disclosure.