1diff --git a/SECURITY.md b/SECURITY.md
2new file mode 100644
3index 0000000000000000000000000000000000000000..cda53379f78c975dddd21f4b8c10b964a2053be6
4--- /dev/null
5+++ b/SECURITY.md
6@@ -0,0 +1,22 @@
7+# Security Policy
8+
9+## Supported Versions
10+
11+At the moment Oh My Zsh only considers the very latest commit to be supported.
12+We combine that with our fast response to incidents, so risk is minimized.
13+
14+| Version | Supported |
15+|:-------------- |:------------------ |
16+| master | :white_check_mark: |
17+| other commits | :x: |
18+
19+In the near future we will introduce versioning, so expect this section to change.
20+
21+## Reporting a Vulnerability
22+
23+If you find a vulnerability, email all the maintainers directly at:
24+
25+- Robby: robby [at] planetargon.com
26+- Marc: hello [at] mcornella.com
27+
28+**Do not open an issue or Pull Request directly**, because it might reveal the vulnerability.