diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f5d0aa6
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues privately through GitHub's private vulnerability reporting: open the [Security tab](https://github.com/sourcelevel/faraday-http-cache/security/advisories/new) of this repository and use "Report a vulnerability". Don't open a public issue or pull request for something you believe is a security problem.
+
+You'll get an acknowledgement within a week. If the report is accepted we'll work on a fix, publish a GitHub Security Advisory with credit to you, and release a fixed gem to RubyGems.
+
+## Supported versions
+
+Only the latest release on the 2.x line receives security fixes.