diff --git a/README.md b/README.md
index 7cc87d639c..98316a74eb 100644
--- a/README.md
+++ b/README.md
@@ -77,3 +77,22 @@ find an updated list at <http://cms-dev.github.io/testimonials.html>.
 If you used CMS for a contest, selection, or a similar event, and want
 to publicize this information, we would be more than happy to hear
 from you and add it to that list.
+
+Security
+--------
+
+If you (or your agent) believe that you found a security vulnerability
+in CMS, please follow these steps:
+
+1) Ensure that the security issue can actually be reproduced.
+2) Check that the vulnerability is compatible with CMS's threat model.
+   In particular:
+   
+   - A "vulnerability" caused by a configuration key that explicitly
+     mentions needing modification is not a vulnerability.
+   - CMS assumes that the network that services will use for RPCs
+     is trusted. Anything that can be triggered by sending RPCs only
+     is not a vulnerability.
+   
+3) If you did (1) and (2), please open a GitHub Security Advisory under
+   the "Security" tab.