diff --git a/public/.well-known/security.txt b/public/.well-known/security.txt
new file mode 100644
index 0000000000..193e88f6a7
--- /dev/null
+++ b/public/.well-known/security.txt
@@ -0,0 +1,4 @@
+Contact: https://hackerone.com/mergify
+Expires: 2027-10-01T00:00:00.000Z
+Policy: https://docs.mergify.com/security/#vulnerability-disclosure
+Preferred-Languages: en
diff --git a/public/_routes.json b/public/_routes.json
index bc9b8f72dd..69e0cd8c77 100644
--- a/public/_routes.json
+++ b/public/_routes.json
@@ -8,6 +8,7 @@
     "/favicon.ico",
     "/favicon.svg",
     "/robots.txt",
+    "/.well-known/security.txt",
     "/sitemap-index.xml",
     "/sitemap-0.xml",
     "/llms.txt",
diff --git a/src/content/docs/support.mdx b/src/content/docs/support.mdx
index 08ec6eea94..fab55cc6de 100644
--- a/src/content/docs/support.mdx
+++ b/src/content/docs/support.mdx
@@ -26,6 +26,12 @@ If you are stuck, use one of the following channels:
 
 These options are available to every Mergify user.
 
+## Report a Security Vulnerability
+
+Do not send vulnerability reports to support. Report them through our
+[HackerOne bug bounty program](https://hackerone.com/mergify), as described in
+[Vulnerability Disclosure](/security#vulnerability-disclosure).
+
 ## Support Overview
 
 We provide assistance to authorized users directly through the service as well as by email. While