diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 7f4356c4..307f859e 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -111,7 +111,7 @@ mix firecracker.gen
 
 Open a GitHub issue for bugs, with the version, your environment, and a minimal
 reproduction. For anything security-sensitive, **do not open a public issue**
--- email the maintainer at <marko@harmont.dev> instead.
+-- follow [SECURITY.md](SECURITY.md) instead.
 
 You can also ask questions in the [community
 Discord](https://discord.gg/hm-dev).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..f3462f8f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security
+
+Report vulnerabilities privately, through [GitHub's advisory
+form](https://github.com/harmont-dev/hyper/security/advisories/new) or by email
+to <marko@harmont.dev>. Do not open a public issue.
+
+In scope is Hyper's own code: the setuid helper (`native/suidhelper/`), the
+jail, network and device-mapper plumbing it drives, the guest agent, and the
+gRPC API.
+
+Bugs in the host kernel, KVM or Firecracker belong upstream. We track their
+impact on Hyper in public issues.