diff --git a/SECURITY.md b/SECURITY.md
index 41a920b..37039fb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,5 +1,13 @@
 # Security policy
 
+## Reporting a vulnerability
+
+Open the affected repository's **Security** tab, choose **Advisories**, then
+**Report a vulnerability** to send a private report to the maintainer. Include
+the affected package and version, steps to reproduce, and the expected impact.
+Keep vulnerability details out of public issues and pull requests until a fix
+and disclosure are coordinated.
+
 ## Security maintainer
 
 Richard McDaniel (@rmcdaniel) is the sole maintainer and security maintainer of Durable Workflow.