diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..957bf6a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,4 @@
+To report a security issue, please use the GitHub Security Advisory ["Report a Vulnerability"](https://github.com/fragglet/ipxbox/security/advisories/new) tab.
+
+Alternatively, send a GPG-encrypted email to one of the addresses associated with
+[OpenPGP public key 6D2C117E0310664497AA9546F6C2EE9C23354344](https://keyserver.ubuntu.com/pks/lookup?search=6D2C117E0310664497AA9546F6C2EE9C23354344&op=index).