diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..d7a8f392
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,19 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest major release line receives security updates.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues.
+
+Instead, report them privately via [GitHub private vulnerability reporting](https://github.com/namecheap/ec2-github-runner/security/advisories/new).
+
+Please include as much of the following as you can:
+
+- A description of the issue and its potential impact
+- Steps to reproduce or a proof of concept
+- Affected version(s) or commit(s)
+
+You can expect an initial response within 5 business days.