diff --git a/kitty/SECURITY.md b/kitty/SECURITY.md
new file mode 100644
index 000000000..88218d35d
--- /dev/null
+++ b/kitty/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+
+There are no security specific releases of kitty. Security bugs are fixed
+and released just like all other bugs.
+
+## Reporting a vulnerability
+
+Preferably send an email to kovid at kovidgoyal.net or open an issue in the
+GitHub repository, though the latter means you are disclosing the vulnerability
+publicly before it can be fixed.