diff --git a/.github/LICENSE b/LICENSE
similarity index 100%
rename from .github/LICENSE
rename to LICENSE
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..697c90c3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version on `master` is maintained.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security problems, such as a script that could expose secrets or run untrusted code during setup.
+
+Instead, use one of these:
+
+- **GitHub Private Vulnerability Reporting** (preferred): use the [Report a vulnerability](https://github.com/FrancesCoronel/dotfiles/security/advisories/new) button on the Security tab.
+- **Email**: [frances@francescoronel.com](mailto:frances@francescoronel.com)
+
+Please include:
+
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix (optional)
+
+I aim to respond within **72 hours** and will keep you updated while the issue is investigated and fixed.
+
+## Scope
+
+In scope: the scripts and config in this repository.
+
+Out of scope: the third-party tools these dotfiles install (Homebrew packages, apps), which should be reported to their own maintainers.