diff --git a/README.md b/README.md
index 6275a7837..9c30d0bfd 100644
--- a/README.md
+++ b/README.md
@@ -82,3 +82,7 @@ The legacy packages are currently excluded from the pnpm workspace (see `pnpm-wo
 ## Feature flags
 
 We use a trunk-based development approach in this project, where developers commit directly to the main branch and deployments are done regularly. To help accomodate the review/acceptance process, we use feature flags that will conditionally enable/disable certain functionality. These feature flags are based on the currently active [Sanity dataset](https://www.sanity.io/docs/datasets). This allows us to have features that are not yet ready for production enabled in the development dataset, while being disabled in the production dataset.
+
+## Contributing
+
+If you want to report a bug, please create an issue in GitHub unless it is a security issue. If it is a security issue, please follow our Security Reporting Policy in SECURITY.md file.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..e1344f09f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,17 @@
+If you discover a security vulnerability in this project, please follow these steps to responsibly disclose it:
+
+1. **Do not** create a public GitHub issue for the vulnerability.
+
+2. Follow our guideline for Responsible Disclosure Policy at https://www.equinor.com/about-us/csirt to report the issue
+
+The following information will help us triage your report more quickly:
+
+- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+We prefer all communications to be in English.