From 775d39d9aeb1bfb5434c5e726078c8bb4e08cf8c Mon Sep 17 00:00:00 2001
From: Dong Bin <14807942+rabbitism@users.noreply.github.com>
Date: Mon, 30 Mar 2026 16:02:55 +0800
Subject: [PATCH] Revise security policy and add vulnerability reporting
 (#21029)

Updated the security policy to include vulnerability reporting guidelines and removed supported versions section.
---
 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..fcf55a12b9
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in any of our SDKs, tools, services, or repositories, please help us keep the community safe by reporting it responsibly.
+
+You can report security vulnerabilities by emailing **[security@avaloniaui.net](mailto:security@avaloniaui.net)**.
+
+Please avoid disclosing the issue publicly until we have had a reasonable amount of time to investigate and release a patch or mitigation. We review all legitimate reports and will work with you to quickly resolve the issue.
+
+Please note that Avalonia does not operate a bug bounty programme.