diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000000000..7218cd5fb3822
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,13 @@
+# Security policy
+
+Mozilla takes the security of our software seriously. If you believe you have found a security vulnerability in PDF.js, please report it to us as described below.
+
+## Reporting security vulnerabilities
+
+**Please don't report security vulnerabilities through public GitHub issues.**
+
+Instead, please report security vulnerabilities in [Bugzilla](https://bugzilla.mozilla.org/enter_bug.cgi?product=Firefox&component=PDF%20Viewer&groups=firefox-core-security) and make sure that the checkbox in the "Security" section is checked so the required access controls are automatically configured:
+
+![Security checkbox](security.png)
+
+The Mozilla security team will process the bug as described in [Mozilla's security bugs policy](https://www.mozilla.org/en-US/about/governance/policies/security-group/bugs).
diff --git a/.github/security.png b/.github/security.png
new file mode 100644
index 0000000000000..040128166b6bc
Binary files /dev/null and b/.github/security.png differ