diff --git a/README.md b/README.md
index 3a04b44..382eb0d 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,10 @@ See the [installation guide](https://developer.plugchoice.com/sdk/install) for e
 
 Follow the [integration guide](https://developer.plugchoice.com/sdk/get-started). Example apps are in [`ios/Example`](ios/Example) and [`android/example`](android/example).
 
+## Security
+
+Email security issues to [security@plugchoice.com](mailto:security@plugchoice.com). See [SECURITY.md](SECURITY.md).
+
 ## License
 
 See [LICENSE](LICENSE).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..94e6da4
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Email security issues to [security@plugchoice.com](mailto:security@plugchoice.com). Please don't open a public GitHub issue for them.
+
+Include what you can of:
+
+- what the issue is and what an attacker could do with it;
+- the steps to reproduce it, or a proof of concept;
+- the SDK version and platform (iOS, Android or React Native), and the device and OS version;
+- whether it involves the hosted flow on `connect.plugchoice.com` or the SDK API at `api.plugchoice.com/sdk/v1`.
+
+Give us time to fix the issue before you share it with anyone else.
+
+## Supported versions
+
+The SDK is in beta (0.x). Security fixes go into the latest release only, so update to it.
+
+## More
+
+[Security](https://developer.plugchoice.com/sdk/security) in the documentation describes what the SDK and the hosted flow can do on a device, and how they're locked down.