diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 9adcb49f51..17345666f6 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -35,3 +35,6 @@ container-builder/ @nvidia/cuopt-infra-codeowners
 /dependencies.yaml @nvidia/cuopt-ci-codeowners
 /build.sh          @nvidia/cuopt-ci-codeowners
 pyproject.toml     @nvidia/cuopt-ci-codeowners
+
+# Ops code owners
+/SECURITY.md             @rapidsai/ops-codeowners
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index cd72e98a8d..8c05b5d1b0 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -163,6 +163,7 @@ jobs:
           - '!CONTRIBUTING.md'
           - '!LICENSE'
           - '!README.md'
+          - '!SECURITY.md'
           - '!ci/build_wheel*.sh'
           - '!ci/check_style.sh'
           - '!ci/docker/**'
@@ -219,6 +220,7 @@ jobs:
           - '!CONTRIBUTING.md'
           - '!LICENSE'
           - '!README.md'
+          - '!SECURITY.md'
           - '!agents/**'
           - '!ci/build_docs.sh'
           - '!ci/build_python.sh'
@@ -287,6 +289,7 @@ jobs:
           - '!CONTRIBUTING.md'
           - '!LICENSE'
           - '!README.md'
+          - '!SECURITY.md'
           - '!agents/**'
           - '!ci/build_docs.sh'
           - '!ci/build_wheel*.sh'
@@ -352,6 +355,7 @@ jobs:
           - '!CONTRIBUTING.md'
           - '!LICENSE'
           - '!README.md'
+          - '!SECURITY.md'
           - '!agents/**'
           - '!ci/build_cpp.sh'
           - '!ci/build_docs.sh'
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..ada890837b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,40 @@
+# Security
+
+## Reporting Security Issues
+
+> [!WARNING]
+> Do not report security vulnerabilities through public GitHub issues!
+
+Instead, please submit a private vulnerability report, see below.
+
+## Reporting a Vulnerability
+
+1. **NVIDIA Vulnerability Disclosure Program (preferred)**
+   Submit through the NVIDIA Product Security Incident Response Team (PSIRT) web form (<https://www.nvidia.com/en-us/security/report-vulnerability/>)
+   This is the fastest path to triage and tracking.
+
+2. **Email NVIDIA PSIRT**
+   `psirt@nvidia.com` — encrypt sensitive reports with the
+   [NVIDIA PSIRT PGP key](https://www.nvidia.com/en-us/security/pgp-key).
+
+3. **GitHub Private Vulnerability Reporting**
+   Use the **Security and quality** tab on this repository → *Report a vulnerability*.
+
+## Report Details
+
+We prefer all communications to be in English.
+
+Reports should include the following:
+
+* reproducible example showing how the vulnerability can be exploited
+* statement about the impact (including affected versions)
+
+And we'd appreciate if they also include:
+
+* statement about whether you are interested in implementing the fix yourself
+
+## Disclosure Policy
+
+NVIDIA PSIRT will acknowledge receipt and coordinate triage, fix development, and coordinated disclosure.
+
+More on NVIDIA's response process: <https://www.nvidia.com/en-us/security/psirt-policies/>.