diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..a6984dd
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the latest release of the 2.x series.
+
+| Version | Supported |
+| ------- | --------- |
+| 2.x     | Yes       |
+| < 2.0   | No        |
+
+## Reporting a Vulnerability
+
+Please do **not** report security vulnerabilities through public GitHub issues,
+discussions or pull requests.
+
+Report them privately using GitHub's
+[private vulnerability reporting](https://github.com/Masterminds/html5-php/security/advisories/new)
+("Security" tab → "Report a vulnerability").
+
+Please include as much of the following as you can:
+
+- the affected version(s) and PHP version,
+- a description of the issue and its impact,
+- a minimal HTML input or code sample that reproduces it.
+
+We will acknowledge your report, keep you informed while we investigate, and
+coordinate a fix and disclosure with you. Once a fix is released, the
+vulnerability will be published as a GitHub security advisory.