diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3e440d1
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+## Overview
+
+We welcome reports from the security community and are committed to working collaboratively to investigate and resolve vulnerabilities responsibly.
+
+---
+
+## Reporting a Potential Vulnerability
+
+If you find a security vulnerability please submit details through our [bug bounty program](https://www.mozilla.org/en-US/security/web-bug-bounty/) [[FAQ](https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/)]. Always submit potential security vulnerabilities via the [webform](https://hackerone.com/mozilla); _never_ submit security-related bugs through a Github Issue or by email.
+
+### What to include
+
+To help us triage quickly, please provide:
+
+- A clear description of the issue
+- Steps to reproduce (or a proof of concept)
+- Affected versions / environments
+- Potential impact (what an attacker could achieve)
+- Any suggested mitigations or fixes
+
+### Non-security bugs
+
+Other bugs, that have no potential security implications, can be submitted via our [addons issue tracker](https://github.com/mozilla/addons/issues/new/choose).