From b0e449189de7df427316dc25f909a0b3b3ecc1a8 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Mon, 19 Oct 2026 15:17:21 +0000
Subject: [PATCH] Document private vulnerability reporting

---
 SECURITY.md | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/SECURITY.md b/SECURITY.md
index 41a920b..37039fb 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,5 +1,13 @@
 # Security policy
 
+## Reporting a vulnerability
+
+Open the affected repository's **Security** tab, choose **Advisories**, then
+**Report a vulnerability** to send a private report to the maintainer. Include
+the affected package and version, steps to reproduce, and the expected impact.
+Keep vulnerability details out of public issues and pull requests until a fix
+and disclosure are coordinated.
+
 ## Security maintainer
 
 Richard McDaniel (@rmcdaniel) is the sole maintainer and security maintainer of Durable Workflow.