diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..75813ad
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Report it privately through GitHub's advisory form:
+https://github.com/GSTJ/react-native-code-push-plugin/security/advisories/new
+
+Don't open a public issue for a security problem.
+
+## Supported Versions
+
+Fixes ship in a new release off the latest published version. Stay on it; there are no backport branches.