diff --git a/security.txt b/security.txt
new file mode 100644
index 0000000000..fb12af2e6f
--- /dev/null
+++ b/security.txt
@@ -0,0 +1,4 @@
+# Our security contact
+Contact: mailto:express-security@lists.openjsf.org
+# Our security policy
+Policy: https://github.com/expressjs/express/security/policy
\ No newline at end of file