diff --git a/README.md b/README.md
index 317e3c9..e2b23e0 100644
--- a/README.md
+++ b/README.md
@@ -609,3 +609,7 @@ See [CONTRIBUTING.md](http://github.com/grpc-ecosystem/grpc-gateway/blob/master/
 
 gRPC-Gateway is licensed under the BSD 3-Clause License.
 See [LICENSE.txt](https://github.com/grpc-ecosystem/grpc-gateway/blob/master/LICENSE.txt) for more details.
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for how to report a vulnerability.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..015da9b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,17 @@
+# Security Policy
+
+This document describes the security policy for the grpc-gateway repository.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it by emailing
+security@example.com. Please do not open a public GitHub issue for security
+vulnerabilities, so that the issue can be addressed before it is disclosed
+publicly.
+
+## Supported Versions
+
+grpc-gateway is released via tagged versions (see the
+[Releases](https://github.com/grpc-ecosystem/grpc-gateway/releases) page).
+Only the latest release is actively supported with security fixes; users
+are encouraged to stay up to date with the latest tagged release.