diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..29c242a
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest published version of this project is supported with security updates.
+
+Older versions are not supported. If a vulnerability affects an older version, please first verify whether it is still present in the latest version.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it through **GitHub Security Advisories** using private vulnerability reporting.
+
+- Go to the repository’s **Security** tab.
+- Choose **Report a vulnerability**.
+- Submit the details privately through GitHub’s advisory workflow.
+- <https://github.com/jkowalleck/rfc3987-syntax2/security/advisories/new>
+
+
+Please **do not** open public issues for security vulnerabilities.
+
+## What to Include in a Report
+
+To help us triage and fix issues quickly, please include:
+
+- A clear description of the vulnerability
+- Steps to reproduce
+- A proof of concept (if available)
+- Impact assessment
+- Suggested remediation (if known)
+
+## Response Process
+
+We will review reports and assess impact/severity.
+
+If the report is accepted, a fix will be developed and released in the latest supported version, and a coordinated disclosure will be made through GitHub Security Advisories.