diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..0987f37db
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security policy
+
+## Supported versions
+
+Only lastest two minor version releases are supported for patching security fixes.
+
+## Reporting a vulnerability
+
+Please send report privately to [security@gogs.io](mailto:security@gogs.io), and include how would you like to be credited.
+
+Thank you!