diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d4e6a35
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+# Security policy
+
+## Report a vulnerability
+
+Report suspected vulnerabilities in aictrl CLI through [GitHub private vulnerability reporting](https://github.com/aictrl-dev/cli/security/advisories/new). You can also open this repository's Security and quality tab and choose **Report a vulnerability**.
+
+Please include:
+
+- The affected CLI version and relevant operating system or runtime details.
+- A minimal reproduction and the observed behavior.
+- The potential security impact.
+- Sanitized logs or examples that help reproduce the problem.
+
+Do not post exploit details, credentials, tokens, or private data in public issues. Remove secrets and personal data from any logs or examples you share.
+
+For ordinary bugs without a suspected security impact, use the [public issue tracker](https://github.com/aictrl-dev/cli/issues).