diff --git a/README.md b/README.md
index 98da194c1b..7dc548c53f 100644
--- a/README.md
+++ b/README.md
@@ -63,3 +63,9 @@ Check out [the documentation](https://backstage.io/docs/getting-started) on how
 Copyright 2020-2021 © The Backstage Authors. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page: https://www.linuxfoundation.org/trademark-usage
 
 Licensed under the Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0
+
+## Security
+
+Please report sensitive security issues via Spotify's [bug-bounty program](https://hackerone.com/spotify) rather than GitHub.
+
+For further details please see our complete [security release process](SECURITY.md).