diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f021441
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+# Security Policy
+
+This policy covers every Budavári Schönherz Stúdió repository that has no `SECURITY.md` of its own.
+
+## Supported versions
+
+Only the latest release, deployed from the default branch, gets security fixes.
+
+## Reporting a vulnerability
+
+**Do not open a public issue, discussion or pull request for a security vulnerability.**
+
+Report it privately through GitHub's private vulnerability reporting:
+
+1. Open the affected repository's **Security** tab.
+2. Choose **Report a vulnerability**. The direct link is `https://github.com/BSStudio/<repository>/security/advisories/new`.
+
+Please include the affected version or commit, the steps to reproduce it, and its impact.
+
+## Disclosure
+
+We acknowledge reports within 7 days and keep you updated while we work on a fix. Once a fix is released we publish a GitHub security advisory and credit you, unless you ask us not to. Please give us a reasonable amount of time to fix the issue before you disclose it publicly.