diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..41a920b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,9 @@
+# Security policy
+
+## Security maintainer
+
+Richard McDaniel (@rmcdaniel) is the sole maintainer and security maintainer of Durable Workflow.
+
+His security responsibilities include reviewing vulnerability reports, assessing security issues, developing and reviewing fixes, adding security regression tests, and coordinating security updates and disclosures.
+
+These responsibilities cover the Durable Workflow repositories he maintains, including the core workflow runtime, orchestration server, Waterline, PHP/Python/Rust SDKs, and command-line tooling.
diff --git a/profile/README.md b/profile/README.md
index 85b390c..c34edb6 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -44,3 +44,7 @@ activity to a worker in another.
 Start with the [2.0 documentation](https://durable-workflow.com/docs/2.0/) or
 open the [Sample App](https://github.com/durable-workflow/sample-app) for
 runnable embedded and service-mode examples.
+
+## Maintainer
+
+Durable Workflow is created and maintained by Richard McDaniel (@rmcdaniel), who is also responsible for security maintenance, vulnerability triage, and security fixes across the project.