diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..64a7347
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Important security fixes will be back-ported to at least the two most recent versions.
+
+## Reporting a Vulnerability
+
+This repository uses GitHub's [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) feature.
+
+You can submit a vulnerability report at https://github.com/copilot-extensions/preview-sdk.js/security/advisories/new.