diff --git a/NOTICE b/NOTICE
index d76665b..611d03b 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,2 +1,18 @@
 Spreedly Composer Java Server SDK
 Copyright 2025-2026 Spreedly, Inc.
+
+This SDK depends on the following libraries at runtime. Maven resolves them
+alongside the SDK; they are not bundled in its JAR. Full license texts are in
+THIRD-PARTY-LICENSES.
+
+- com.google.code.gson:gson (Apache-2.0)
+- com.google.errorprone:error_prone_annotations (Apache-2.0)
+- com.squareup.okhttp3:okhttp (Apache-2.0)
+- com.squareup.okio:okio (Apache-2.0)
+- com.squareup.okio:okio-jvm (Apache-2.0)
+- org.apache.commons:commons-lang3 (Apache-2.0)
+- org.jetbrains:annotations (Apache-2.0)
+- org.jetbrains.kotlin:kotlin-stdlib (Apache-2.0)
+- org.jetbrains.kotlin:kotlin-stdlib-common (Apache-2.0)
+- org.jetbrains.kotlin:kotlin-stdlib-jdk7 (Apache-2.0)
+- org.jetbrains.kotlin:kotlin-stdlib-jdk8 (Apache-2.0)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..22792fe
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting Security Vulnerabilities
+
+Spreedly takes security seriously and appreciates your help in keeping our products and services secure. If you discover a security vulnerability in this repository, please report it to us using one of the following methods. **Do not** open a public GitHub issue, pull request, or discussion describing the vulnerability.
+
+### Option 1: Spreedly Help Center
+
+Submit a security vulnerability report through the [Spreedly Help Center](https://spreedly.com/support/) by submitting a request to Customer Support. This will open a support ticket for you, allowing you to securely communicate with our security team.
+
+### Option 2: Spreedly Security Team
+
+Email our security team directly at **security@spreedly.com** with details about the vulnerability you've discovered.
+
+## What to Include in Your Report
+
+When reporting a security vulnerability, please include:
+
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact of the vulnerability
+- Any suggested fixes or mitigations (if available)
+
+## Response Timeline
+
+We will acknowledge receipt of your report within 48 hours and provide an initial assessment within 5 business days. We'll keep you informed of our progress as we work to address the issue.
+
+## Disclosure Policy
+
+We ask that you:
+
+- Allow us a reasonable amount of time to address the vulnerability before public disclosure
+- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services
+- Not access or modify data that does not belong to you
+
+Thank you for helping keep Spreedly and our customers secure.