diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..697d801
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,19 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are made in the latest release only.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues or pull requests.**
+
+Report them through Automattic's HackerOne programme instead: https://hackerone.com/automattic
+
+Reporting through HackerOne can also make you eligible for Automattic's bug bounty. Please read the [bounty eligibility guidelines](https://hackerone.com/automattic) before submitting reports.
+
+Please include:
+
+- a description of the vulnerability and its impact
+- steps to reproduce it
+- a suggested fix, if you have one