diff --git a/AGENTS.md b/AGENTS.md
index a1766973..90eee4a3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -24,7 +24,7 @@ from `mergify-ci-bot`. Suggestions are welcome as issues.
 
 ## Owned here
 
-- `.github/workflows/ci.yaml`, `.mergify.yml`, `renovate.json` and this `AGENTS.md`.
+- `.github/workflows/ci.yaml`, `.mergify.yml`, `renovate.json`, `SECURITY.md` and this `AGENTS.md`.
 - The releases, published by `mergify-ci-bot`, never by hand. A release carrying
   the CLI binaries is Latest, which install.sh, `mergify self-update`, the
   Homebrew tap and the docs' CLI reference all follow.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..0e5575f1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,24 @@
+# Security Policy
+
+This policy covers the `mergify` CLI, its installer (`install.sh`), and the
+agent skills and plugins published in this repository.
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues,
+discussions or pull requests.
+
+Report them privately through Mergify's bug bounty program on HackerOne:
+<https://hackerone.com/mergify>. For other security questions, write to
+<security@mergify.com>.
+
+A useful report says which version you ran (`mergify --version`), how to
+reproduce the issue and what an attacker gains from it.
+
+Mergify's vulnerability disclosure policy is published at
+<https://docs.mergify.com/security/#vulnerability-disclosure>.
+
+## Supported versions
+
+Security fixes ship in a new release of the CLI. `mergify self-update`,
+the installer and the Homebrew tap all install the latest release.