diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index bc9f015..7de78b9 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -19,6 +19,13 @@ Test all contributions locally before submitting Pull Requests by running `./run
 
 Relevant coding style guidelines are outlined in [CodingStyle.md](CodingStyle.md). This project uses [Ruff](https://docs.astral.sh/ruff/) for linting and formatting; run `uv run ruff format .` to format and `uv run ruff check .` to lint before submitting a Pull Request. Both run in CI, and the [pre-commit](https://pre-commit.com) hooks in `.pre-commit-config.yaml` apply them automatically on commit once installed with `uv run pre-commit install`.
 
+## Reporting Feature Requests, Bugs, Vulnerabilities and other Issues
+
+If you find a bug in ThunderCloud, please file a detailed report as a GitHub Issue. We currently do not utilize an Issue template, but please be as thorough as possible in your report. There is no such thing as too much information.
+
+Likewise, if you have a Feature Request, please file a detailed Issue, explaining the feature's functionality and use cases. New Features should be beneficial to the broader community, so be sure to consider that before filing.
+
+If you have identified a potential security vulnerability in ThunderCloud, follow [these steps](SECURITY.MD) to report it privately.
 
 ## Recognizing Contributions
 
@@ -28,9 +35,3 @@ This project uses the [All Contributors](https://allcontributors.org) bot to rec
 
 See the [emoji key](https://allcontributors.org/docs/en/emoji-key) for the full list of contribution types. The bot opens a pull request updating the README and `.all-contributorsrc`.
 
-
-## Reporting Feature Requests, Bugs and other Issues
-
-If you find a bug in ThunderCloud, please file a detailed report as a GitHub Issue. We currently do not utilize an Issue template, but please be as thorough as possible in your report. There is no such thing as too much information.
-
-Likewise, if you have a Feature Request, please file a detailed Issue, explaining the feature's functionality and use cases. New Features should be beneficial to the broader community, so be sure to consider that before filing.
diff --git a/SECURITY.MD b/SECURITY.MD
new file mode 100644
index 0000000..dd2a944
--- /dev/null
+++ b/SECURITY.MD
@@ -0,0 +1,3 @@
+# Security
+
+If you've found a vulnerability or a potential vulnerability in ThunderCloud, please let us know using the 'Report a vulnerability' button under the [Security and quality > Advisories](https://github.com/EarthSpark/thundercloud/security/advisories) section of the project.