diff --git a/README.md b/README.md
index 14d46d92..6ce2b8c7 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,10 @@ You can use the instance of JARR run by the maintainer on [app.jarr.info](https:
 
 To use and host your own instance of JARR please see [installation instruction](https://github.com/jaesivsm/JARR/blob/master/INSTALL.md)
 
+## Security
+
+Please refer to the [security instruction](https://github.com/jaesivsm/JARR/blob/master/SECURITY.md).
+
 ## License
 
 JARR is under the [GNU Affero General Public License version 3](https://www.gnu.org/licenses/agpl-3.0.html).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..0cf121b2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,5 @@
+# Reporting security issues
+
+For common issues the recommended way is to open a [Pull Request](https://github.com/jaesivsm/JARR/issues/new).
+
+For security issues related to either JARR itself or its [main instance](https://app.jarr.info), the best way is to contact [the main maintenaner by mail](mailto:contact@jarr.info).