diff --git a/SECURITY.md b/SECURITY.md
index 0abbf9532d..fe6468e8d0 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,3 +1,23 @@
-To report a security issue, file a [Private Security Report](https://github.com/Canonical/github-runner-operator/security/advisories/new) with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue.
+# Security policy
 
-The [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/disclosure-policy) contains more information about what you can expect when you contact us and what we expect from you.
+## What qualifies as a security issue
+
+Credentials leakage, outdated dependencies with known vulnerabilities, and
+other issues that could lead to unprivileged or unauthorised access to the
+database or the system.
+
+## Reporting a vulnerability
+
+The easiest way to report a security issue is through GitHub.
+See [Privately reporting a security
+vulnerability](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability#privately-reporting-a-security-vulnerability)
+for instructions.
+
+The repository admins will be notified of the issue and will work with you
+to determine whether the issue qualifies as a security issue and, if so, in
+which component. We will then handle figuring out a fix, getting a CVE
+assigned and coordinating the release of the fix.
+
+The [Ubuntu Security disclosure and embargo policy](https://ubuntu.com/security/disclosure-policy)
+contains more information about what you can expect when you contact us, and what we
+expect from you.