diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..c14679c
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release and the current `master` branch are supported. Please verify that the issue exists in the [latest release](https://github.com/Raphire/Win11Debloat/releases/latest) before reporting it.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it privately through GitHub. **Do not open a public issue.**
+
+To submit a report:
+
+1. Go to the repository's [Security tab](https://github.com/Raphire/Win11Debloat/security).
+2. Select **Report a vulnerability**.
+3. Describe the issue, including the affected version, steps to reproduce, and potential security impact.
+
+Because Win11Debloat runs with administrator privileges, security issues that could allow unintended or unauthorized actions are considered in scope.
+
+This project is maintained by volunteers. Security reports are handled on a best-effort basis, without guaranteed response times.
+
+## What Is Not a Vulnerability
+
+- **Antivirus false positives:** Report these as regular issues.
+- **Intended functionality:** Changes such as removing apps or disabling telemetry are not security vulnerabilities. Report unexpected behavior as a regular issue.