Index: SECURITY.md
==================================================================
--- SECURITY.md
+++ SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Due to the nature of the software in this repository (scripts for **REDUCE**),
+it is unlikely (but not impossible) that any security vulnerabilities exist.
+
+However, if any are found that are **specific** to this package, they should
+be reported upstream to [AL Software](http://alsoftiphone.com/).
+
+Vulnerabilities in **REDUCE** should be reported via the
+[REDUCE Bug Reporting and Ticketing System](https://sourceforge.net/p/reduce-algebra/bugs/);
+please check "Mark as Private" when submitting the report.