diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 9f175644..b483a7ef 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -72,7 +72,14 @@ that you are using supported versions of Docker and go.
 ### Security Vulnerabilities
 
 **NOTE**: If you find a security vulnerability, do NOT open an issue.
-Email [Redis Open Source (<oss@redis.com>)](mailto:oss@redis.com) instead.
+
+If you believe you have found a security vulnerability, to ensure proper
+review and assessment, we kindly ask vulnerability reports be submitted
+through our
+[Redis Vulnerability Disclosure Program](https://redis.io/redis-responsible-vulnerability-disclosure/).
+Alternatively reach out via email to
+[security@redis.com](mailto:security@redis.com). See
+[SECURITY.md](SECURITY.md) for the full policy.
 
 In order to determine whether you are dealing with a security issue, ask
 yourself these two questions:
@@ -83,8 +90,8 @@ yourself these two questions:
 
 If the answer to either of those two questions are *yes*, then you're
 probably dealing with a security issue. Note that even if you answer
-*no*  to both questions, you may still be dealing with a security
-issue, so if you're unsure, just email [us](mailto:oss@redis.com).
+*no* to both questions, you may still be dealing with a security
+issue, so if you're unsure, report it through the channels above.
 
 ### Everything Else
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..00d24ace
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported Versions
+
+go-redis is generally backward compatible with very few exceptions, so we
+recommend users to always use the latest version to experience stability,
+performance and security. Security fixes are released as part of the latest
+release of the v9 line; older major versions are no longer maintained.
+
+## Reporting a Vulnerability
+
+If you believe you have found a security vulnerability, to ensure proper
+review and assessment, we kindly ask vulnerability reports be submitted
+through our
+[Redis Vulnerability Disclosure Program](https://redis.io/redis-responsible-vulnerability-disclosure/).
+Alternatively reach out via email to
+[security@redis.com](mailto:security@redis.com).
+
+Please do **not** report security vulnerabilities through public GitHub
+issues.