diff --git a/SECURITY.rst b/SECURITY.rst
new file mode 100644
index 00000000000..53066b744a8
--- /dev/null
+++ b/SECURITY.rst
@@ -0,0 +1,23 @@
+Security
+========
+
+Reporting a Vulnerability
+-------------------------
+
+Please do not report security vulnerabilities via public GitHub issues.
+
+Instead, please report them via `GitHub Security Advisories <https://github.com/sphinx-doc/sphinx/security/advisories/new>`_ (preferred) or by emailing the maintainers as described in :doc:`CONTRIBUTING`.
+
+We will acknowledge receipt within two working days and will work with you to understand the issue, provide a fix, and coordinate disclosure.
+
+Supported Versions
+------------------
+
+Security fixes are provided for the latest released version of Sphinx and, when feasible, for the previous minor version.
+
+Disclosure Policy
+-----------------
+
+When a vulnerability is fixed, it will be announced in the `CHANGES` and via a GitHub Security Advisory. Please allow us time to prepare a fix and advisory before public disclosure.
+
+For more information, see `GitHub's documentation on reporting security vulnerabilities <https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/information-about-security-advisories>`_.