diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 00000000..da665cd9
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,6 @@
+grocy is not an enterprise application and neither one you (should) host publicly (means without authentication) on the internet.
+
+So unless something really bad can be abused _unauthenticated_,
+please just open a regular issue on the [GitHub issue tracker](https://github.com/grocy/grocy/issues/new/choose).
+
+You can also contact me directly, please see [berrnd.de](https://berrnd.de) for any contact information.