diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..e43399d1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,10 @@
+# Security Policy
+
+## Supported Versions
+
+Only the most recent major version is regularly updated and receives security fixes.
+
+## Reporting a Vulnerability
+
+Please use the project's [private vulnerability reporting feature](https://github.com/bzkf/obds-to-fhir/security/advisories)
+to report any vulnerabilities. For more information, see <https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability>