diff --git a/README.md b/README.md
index da7a670..dc3c6ec 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,8 @@ licensed under the [Apache License, version 2.0](https://www.apache.org/licenses
 
 Because of how Python internally stores numbers, it is very hard (if not impossible) to make a pure-Python program secure against timing attacks. This library is no exception, so use it with care. See https://securitypitfalls.wordpress.com/2018/08/03/constant-time-compare-in-python/ for more info.
 
+For instructions on how to best report security issues, see our [Security Policy](https://github.com/sybrenstuvel/python-rsa/blob/main/SECURITY.md).
+
 ## Setup of Development Environment
 
 ```