diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..daba492
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+# Responsibly reporting security vulnerabilities
+
+If you believe you have found a security vulnerability in a software project maintained by INN, there are many ways to contact us without filing a GitHub issue:
+
+- Send an email to support@inn.org: this forwards TKTK
+- Send an email to nerds@inn.org: this forwards TKTK, bypassing TKTK
+- Send physical mail to TKTK address