diff --git a/.gitignore b/.gitignore
index a2cb92dd5406..2ebf07c86e0b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -59,6 +59,7 @@
 !NOTICE
 !README.md
 !RELEASES.md
+!SECURITY.md
 !TEST
 !zfs.release.in
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000000..5d69e8d8b71e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We encourage responsible disclosure of security vulnerabilities. If you
+find something suspicious, we encourage and appreciate your report.
+
+The preferred way to report a vulnerability is to use the
+**"Report a vulnerability"** button under the **Security** tab of the
+OpenZFS GitHub repository. This creates a private communication channel
+between you and the maintainers, allowing us to review the report
+confidentially and respond as quickly as possible.
+
+Please include, if possible:
+
+- A clear description of the issue
+- Steps to reproduce the problem
+- Affected versions or branches
+- Any proof of concept, logs, or screenshots
+- Your assessment of the potential impact
+
+## What to Expect
+
+- We will review security reports as soon as practical.
+- We may ask follow-up questions to better understand the issue.
+- Please allow time for investigation and coordination before public
+  disclosure.
+- If the issue is confirmed, we will work on a fix and release a security
+  update as needed for supported OpenZFS versions.