diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..076c49be7
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+If you believe you've found a security vulnerability in GitNexus, please **do
+not open a public issue or pull request**.
+
+Instead, report it privately via [GitHub Private Vulnerability Reporting](https://github.com/abhigyanpatwari/GitNexus/security/advisories/new),
+so the maintainers can review and fix it before details become public.
+
+Please include reproduction steps and your assessment of the impact. We'll
+acknowledge the report and coordinate a fix and disclosure timeline with you.
+
+Thank you for helping keep GitNexus and its users safe.