diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..0f074bd9e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please don't report security vulnerabilities in public issues, discussions or pull requests.
+
+Instead, report them privately through GitHub. Go to the [Security tab](https://github.com/jesseduffield/lazygit/security) of this repository and click "Report a vulnerability". Only the maintainers can see your report.
+
+Please include:
+
+- the lazygit version (the output of `lazygit --version`) and your operating system
+- the steps to reproduce the problem, ideally as a script that sets up a repository
+- what an attacker can achieve with it
+
+## What happens next
+
+Lazygit is maintained by volunteers in their spare time. We can't promise a fixed response time, but we'll get back to you as soon as we can.
+
+If we confirm the vulnerability, we fix it in private and release a new version. Then we publish a security advisory, request a CVE for it through GitHub, and credit you in the advisory unless you prefer not to be named.
+
+## Supported versions
+
+We only fix security vulnerabilities in the latest release. Please check whether the problem still exists there before you report it.