diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2ce0030
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Owners must have write access to the repo, otherwise GitHub ignores the line.
+*            @hhvrc @LucHeart
+/SECURITY.md @hhvrc @LucHeart
+/.github/    @hhvrc @LucHeart
diff --git a/.github/workflows/ci-tag.yml b/.github/workflows/ci-tag.yml
index 36de5e6..47dc8f2 100644
--- a/.github/workflows/ci-tag.yml
+++ b/.github/workflows/ci-tag.yml
@@ -66,7 +66,13 @@ jobs:
     
     steps:
       - name: Create release
-        uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3  # v3.0.4
-        with:
-          tag_name: ${{ github.ref_name }}
-          prerelease: ${{ contains(github.ref_name, '-rc') }}
\ No newline at end of file
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+          PRERELEASE: ${{ contains(github.ref_name, '-rc') }}
+        run: |
+          gh release create "$TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --verify-tag \
+            --prerelease="$PRERELEASE" \
+            --notes ""
\ No newline at end of file
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f866dd7
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+OpenShock controls devices that people wear, so we take security reports seriously.
+Scope, rules for testing, response times, disclosure and safe harbor are described in the
+**[OpenShock security policy](https://github.com/OpenShock/.github/blob/main/SECURITY.md)**.
+Please read it before testing.
+
+## Reporting a vulnerability
+
+**Do not open a public issue, pull request or Discord thread for a security vulnerability.**
+
+Report it privately through one of these channels:
+
+- [GitHub private vulnerability reporting](https://github.com/OpenShock/RepositoryServer/security/advisories/new) (preferred)
+- Email to [security@openshock.org](mailto:security@openshock.org)
+
+We acknowledge reports within 3 working days (7 days at most), give a triage result within
+14 days, and follow coordinated disclosure with a default deadline of 90 days. OpenShock does not
+pay bounties; reporters are credited in the advisory and in our
+[security acknowledgments](https://github.com/OpenShock/.github/blob/main/SECURITY-ACKNOWLEDGMENTS.md)
+if they wish.
+
+## Supported versions
+
+Only the latest release receives security fixes.