diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..27e04ad
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,37 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report security problems in @dune/plugin-inline-edit **privately**, not
+through a public issue, pull request, discussion or branch.
+
+Use GitHub's private reporting: open this repository's **Security** tab and
+choose **Report a vulnerability**. That opens a confidential advisory that only
+you and the maintainers can see.
+
+Include what you can of:
+
+- the affected version and how you run it (for Dune itself, `dune --version`),
+- what the problem is and what an attacker could do with it,
+- steps or a minimal example that reproduce it.
+
+You don't need a complete write-up or a fix; a clear description is enough to
+start.
+
+## What to expect
+
+We read every report, confirm whether it is a vulnerability, and work on a fix
+privately. Details are kept out of public commits, branches and the CHANGELOG
+until a fixed release is available. When it ships, the release notes describe
+the problem without a step-by-step recipe, and we credit the reporter if they
+want that.
+
+## Supported versions
+
+Security fixes go into the latest release of `@dune/plugin-inline-edit`; older
+versions are not patched, so upgrade to the newest version first.
+
+## Not security issues
+
+Ordinary bugs, hardening ideas that have no exploit, and questions belong in the
+regular issue tracker.