diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..04dcde52
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+Security Policy
+===============
+
+This project follows the [Connect security policy and reporting
+process](https://connectrpc.com/docs/governance/security).