diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..0371743
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,24 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Do **not** open a public issue for security vulnerabilities. Report them
+privately via [private vulnerability reporting](https://github.com/Archerkattri/ComfyUI-HiCache/security/advisories/new).
+
+Please include:
+
+- Affected version, tag, or commit
+- Description of the issue and its impact
+- Steps to reproduce, exploit, or proof of concept (if available)
+
+## What to Expect
+
+- Acknowledgement of your report within 7 days.
+- A fix or mitigation on a best-effort timeline; credit in the release notes
+  if you want it.
+- Please do not disclose the issue publicly until a fix is released.
+
+## Supported Versions
+
+Security fixes are provided for the latest release on the default branch.
+Older releases are supported on a best-effort basis only.