diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..909746bbd
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest major version is supported with security updates. It can be changed if many people are relying on a specific version for some reason. If this is the case, welcome to file an issue.
+
+## Reporting a Vulnerability
+
+Please contact yangjvn@126.com to report a vulnerability.
+
+- It will be fixed very soon (maybe within 1 week or couple of days) if that vulnerability obviously affects common use cases.
+- Otherwise, it'll be scheduled with a priority just like requested features (which is lower than bugs).
+- If it's declined, you'll receive an email (more oftenly there will be a discuss).