diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..c66120d
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,7 @@
+## Security
+
+Please report any security issue to [https://www.sfdc.co/SubmitVuln](https://www.sfdc.co/SubmitVuln)
+as soon as it is discovered. This project limits its runtime dependencies in
+order to reduce the total cost of ownership as much as can be, but all consumers
+should remain vigilant and have their security stakeholders review all third-party
+products (3PP) like this one and their dependencies.