diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..c6d02936ad
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,2 @@
+To report security vulnerabilities, open a normal bug report in the
+[calibre bug tracker](https://bugs.launchpad.net/calibre) and mark it private.