diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..a926960
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Discussion of security relating to swash happens in the [Linebender Zulip](https://xi.zulipchat.com/), specifically the [#parley channel](https://xi.zulipchat.com/#narrow/channel/205635-parley). All public content can be read without logging in. Depending on the severity of a potential vulnerability, consider privately messaging administrators of the Zulip channel.