diff --git a/.github/workflows/notifications.yml b/.github/workflows/notifications.yml
index 3004795..ef3ed21 100644
--- a/.github/workflows/notifications.yml
+++ b/.github/workflows/notifications.yml
@@ -6,6 +6,9 @@ on:
     tags:
       - '*'
 
+# The job only calls a webhook: no permission for the GITHUB_TOKEN
+permissions: {}
+
 jobs:
   notification:
     runs-on: ubuntu-latest
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..1599c9d
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+Security Policy
+===============
+
+Supported versions
+------------------
+
+Security fixes are released for the latest minor version of the current major version.
+
+Reporting a vulnerability
+-------------------------
+
+**Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.**
+
+Report them privately with the GitHub form:
+[Report a vulnerability](https://github.com/cleverage/archive-process-bundle/security/advisories/new) (Security tab of this
+repository, "Report a vulnerability").
+
+Please include the affected version, a description of the issue and of its impact, and the steps or the configuration to
+reproduce it. You will receive an answer as soon as possible. Once the vulnerability is confirmed, a fix is prepared in a
+private fork, released, and a security advisory is published, crediting you unless you prefer otherwise.