diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..6a1aff3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+This policy applies to the Cartesi repositories that do not have a `SECURITY.md` of their own.
+
+## Supported Versions
+
+Cartesi Rollups is under active development. Please check that the issue is present in the most recent
+release of the affected repository before reporting it.
+
+## Reporting a Vulnerability
+
+**Please do not open a public issue, pull request or discussion for a security problem.**
+
+Report it privately by email to `rollups@cartesi.foundation`. Include the affected
+component and version, the impact, and steps to reproduce.
+
+## What Happens Next
+
+We review each report, decide how to handle it, and reply with the outcome. When a fix is
+released and the issue affects users, we may describe it on the
+[Audit Reports](https://docs.cartesi.io/get-started/audit-reports) page of the Cartesi documentation.
+
+Please give us a reasonable time to fix an issue before you disclose it publicly.
diff --git a/profile/README.md b/profile/README.md
index 5d39639..adcd7d4 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -25,6 +25,7 @@ Cartesi is developed as an open-source public good, with infrastructure availabl
 - [Sequencer](https://github.com/cartesi/sequencer): add optional low-latency soft confirmations and batch inputs for submission to the base chain.
 - [Engineering map](ENGINEERING_MAP.md): find repositories, component status, and dependencies.
 - [Developer community](https://discord.gg/cartesi): ask questions and discuss what you are building.
+- [Security policy](../SECURITY.md): report a vulnerability privately.
 
 Contributions are welcome through each repository's contribution guidelines.
 Licenses vary by component: the Cartesi Machine uses LGPL-3.0; the on-chain Machine verifier, Dave, Rollups Contracts, Rollups Node, Sequencer, and the CLI use Apache-2.0.