diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000000..6f1b1e345ee
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take security seriously. If you discover a security vulnerability in the
+Huly Platform, please report it privately — **do not open a public issue.**
+
+Use GitHub's private vulnerability reporting:
+
+1. Go to the [Security tab](https://github.com/hcengineering/platform/security) of this repository.
+2. Click **"Report a vulnerability"**.
+3. Fill in the advisory with as much detail as possible (affected component,
+   reproduction steps, impact, suggested fix if any).
+
+We'll acknowledge your report, investigate, and coordinate a fix and
+disclosure timeline with you before any public disclosure.
+
+## Supported Versions
+
+Security fixes are applied to the latest release on the `main`/`develop`
+branch. Older versions are not guaranteed to receive patches.
+
+## Scope
+
+This policy covers the code in this repository. Vulnerabilities in
+third-party dependencies should be reported upstream, though we're happy to
+hear about them too if they affect the Platform directly.