diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..eca3fb0d33
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability in Openfire, please report it privately by email to [security@igniterealtime.org](mailto:security@igniterealtime.org).
+
+Please do not disclose security issues through public channels, such as GitHub issues, pull requests, the community forums or chat rooms, until the issue has been addressed.
+
+When reporting, please include as much of the following as you can:
+
+- The version of Openfire that is affected;
+- A description of the issue and its potential impact;
+- Steps to reproduce the issue, or a proof of concept.
+
+We will acknowledge your report, keep you informed of our progress, and coordinate the public disclosure of the issue with you.