diff --git a/NOTICE b/NOTICE
index 568d319..65eb279 100644
--- a/NOTICE
+++ b/NOTICE
@@ -1,2 +1,12 @@
 Spreedly Composer Python Server SDK
 Copyright 2025-2026 Spreedly, Inc.
+
+This SDK depends on the following packages at runtime. pip installs them
+alongside the SDK; they are not bundled with it. Full license texts are in
+THIRD-PARTY-LICENSES.
+
+- requests (Apache-2.0)
+- urllib3 (MIT)
+- idna (BSD-3-Clause)
+- charset-normalizer (MIT)
+- certifi (MPL-2.0)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..22792fe
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting Security Vulnerabilities
+
+Spreedly takes security seriously and appreciates your help in keeping our products and services secure. If you discover a security vulnerability in this repository, please report it to us using one of the following methods. **Do not** open a public GitHub issue, pull request, or discussion describing the vulnerability.
+
+### Option 1: Spreedly Help Center
+
+Submit a security vulnerability report through the [Spreedly Help Center](https://spreedly.com/support/) by submitting a request to Customer Support. This will open a support ticket for you, allowing you to securely communicate with our security team.
+
+### Option 2: Spreedly Security Team
+
+Email our security team directly at **security@spreedly.com** with details about the vulnerability you've discovered.
+
+## What to Include in Your Report
+
+When reporting a security vulnerability, please include:
+
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact of the vulnerability
+- Any suggested fixes or mitigations (if available)
+
+## Response Timeline
+
+We will acknowledge receipt of your report within 48 hours and provide an initial assessment within 5 business days. We'll keep you informed of our progress as we work to address the issue.
+
+## Disclosure Policy
+
+We ask that you:
+
+- Allow us a reasonable amount of time to address the vulnerability before public disclosure
+- Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services
+- Not access or modify data that does not belong to you
+
+Thank you for helping keep Spreedly and our customers secure.