diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..52f06a0
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,40 @@
+# Security Policy
+
+## Supported Versions
+
+The latest release in the v1 series is the actively supported version.
+
+| Version | Security support |
+| --- | --- |
+| Latest v1 release | Supported |
+| Earlier v1 releases | Please upgrade; fixes are evaluated case by case |
+| v0 | Not supported |
+
+We recommend upgrading to the latest v1 release before reporting an issue that
+may already have been fixed.
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities through GitHub's
+[private vulnerability reporting](https://github.com/shamaton/msgpackgen/security/advisories/new).
+
+Do not open a public issue or discussion for an undisclosed vulnerability. In
+your private report, include the following when possible:
+
+- The affected package and version
+- A description of the impact and attack scenario
+- Minimal steps or code needed to reproduce the issue
+- Any suggested mitigation or fix
+
+If you are unsure whether an issue belongs to
+[msgpackgen](https://github.com/shamaton/msgpackgen) or the
+[msgpack runtime library](https://github.com/shamaton/msgpack), report it
+privately to either repository. The maintainers will triage it appropriately.
+
+Please do not include credentials, production data, or other secrets in the
+report.
+
+The maintainers will review reports as availability allows. Response and fix
+timelines cannot be guaranteed and depend on the severity and complexity of the
+issue. Please allow time for investigation and coordinated disclosure before
+publishing details.