diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..048f70a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security
+
+## Supported versions
+
+Octoplex is currently alpha software. Security updates will be targeted to the
+`main` branch.
+
+## Reporting a vulnerability
+
+Please report any vulnerability privately through GitHub:
+https://github.com/rfwatson/octoplex/security