diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..213b9fc
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Report vulnerabilities in this repository privately, through GitHub: open the repository's
+**Security** tab and choose **Report a vulnerability**. Please don't open a public issue or pull
+request for a security problem.
+
+Include the example's folder, what an attacker could do, and the steps to reproduce it.
+
+## Scope
+
+This repository holds example applications that show how to use Permit.io. They are built to run
+locally against a Permit environment made for them, not as production services. Reports about the
+examples' own code, their dependencies and their CI workflows are in scope.