diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..05f5dd91
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Reporting vulnerabilities
+
+Report suspected vulnerabilities privately to the repository owner. Do not publish credentials, private infrastructure, precise sensitive locations, proprietary imagery, private datasets, model artifacts, database snapshots or exploit-sensitive evidence in a public issue.
+
+Include the affected commit/component, minimal reproduction conditions using synthetic data where possible, expected and observed behaviour, impact, and whether the issue affects ingestion, geospatial processing, model inference, exports, authorization, deployment or data retention.
+
+## Data boundary
+
+Geospatial inputs and derived outputs can reveal people, assets and sensitive locations. Treat screenshots, contact sheets, coordinates, source archives, SQLite/WAL state, model output and exports as potentially sensitive. These belong in external controlled storage, not the source repository.
+
+Never commit live `.env` files, credentials, private keys, production databases, unpublished imagery, customer data or local AI-workspace artifacts.