diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..995eb076
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | `socket.io` version | Supported          |
+|---------|---------------------|--------------------|
+| 6.x     | 4.x                 | :white_check_mark: |
+| 4.x     | 3.x                 | :white_check_mark: |
+| 3.5.x   | 2.4.x               | :white_check_mark: |
+| < 3.5.0 | < 2.4.0             | :x:                |
+
+## Reporting a Vulnerability
+
+To report a security vulnerability in this package, please send an email to [@darrachequesne](https://github.com/darrachequesne) (see address in profile) describing the vulnerability and how to reproduce it.
+
+We will get back to you as soon as possible and publish a fix if necessary.
+
+:warning: IMPORTANT :warning: please do not create an issue in this repository, as attackers might take advantage of it. Thank you in advance for your responsible disclosure.
+
+## History
+
+- Jan 2022: [Uncaught exception in engine.io](https://github.com/socketio/engine.io/security/advisories/GHSA-273r-mgr4-v34f) (CVE-2022-21676)
+- Nov 2022: [Uncaught exception in engine.io](https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w) (CVE-2022-41940)