diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..558801b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security Policy
+
+37signals takes security seriously and appreciates responsible disclosure. Our full policy,
+including response commitments, is at
+[37signals.com/policies/security/response](https://37signals.com/policies/security/response/).
+
+**Do not open a public issue for security bugs.**
+
+## Reporting a vulnerability
+
+**Open-source libraries and ONCE apps** (most of what's on this GitHub org): report privately via
+GitHub — the affected repository's **Security** tab → **Report a vulnerability**. These reports
+aren't bounty-eligible, but we accept them via [HackerOne](https://hackerone.com/basecamp) too if
+you'd like the report on your HackerOne record.
+
+**Our products** (Basecamp, HEY, and other assets in scope of our bug bounty program): report
+through HackerOne at [**hackerone.com/basecamp**](https://hackerone.com/basecamp), where in-scope
+reports are eligible for bounties.
+
+Some repositories carry their own `SECURITY.md` with more specific instructions; when present, it
+takes precedence over this default.
+
+## What to expect
+
+We'll acknowledge your report, investigate, and coordinate a fix. Issues stay undisclosed until
+fully investigated and patched; after that, we credit reporters in the disclosure unless they
+prefer otherwise.