diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..3f5c2fcb1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.x     | :white_check_mark: |
+| < 3.0   | :x:                |
+
+## Reporting a Vulnerability
+
+**Please don't report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+Please report the issue to us directly using [private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 248fe125c..0e7e970e1 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -10,6 +10,10 @@ nav_order: 5
 
 ## main
 
+* Add `SECURITY.md`.
+
+  *Joel Hawksley*
+
 * Add Ophelos to list of companies using ViewComponent.
 
    *Graham Rogers*