diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 00000000..2ce00308
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Owners must have write access to the repo, otherwise GitHub ignores the line.
+*            @hhvrc @LucHeart
+/SECURITY.md @hhvrc @LucHeart
+/.github/    @hhvrc @LucHeart
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..e1e25d66
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+OpenShock controls devices that people wear, so we take security reports seriously.
+Scope, rules for testing, response times, disclosure and safe harbor are described in the
+**[OpenShock security policy](https://github.com/OpenShock/.github/blob/main/SECURITY.md)**.
+Please read it before testing.
+
+## Reporting a vulnerability
+
+**Do not open a public issue, pull request or Discord thread for a security vulnerability.**
+
+Report it privately through one of these channels:
+
+- [GitHub private vulnerability reporting](https://github.com/OpenShock/Wiki/security/advisories/new) (preferred)
+- Email to [security@openshock.org](mailto:security@openshock.org)
+
+We acknowledge reports within 3 working days (7 days at most), give a triage result within
+14 days, and follow coordinated disclosure with a default deadline of 90 days. OpenShock does not
+pay bounties; reporters are credited in the advisory and in our
+[security acknowledgments](https://github.com/OpenShock/.github/blob/main/SECURITY-ACKNOWLEDGMENTS.md)
+if they wish.
+
+## Supported versions
+
+Only the latest release receives security fixes.