diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..9bf77c0
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Packages
+
+This policy applies to all published SDK packages in this repository:
+
+- `@supashiphq/javascript-sdk`
+- `@supashiphq/react-sdk`
+- `@supashiphq/vue-sdk`
+
+## Reporting a Vulnerability
+
+Please report vulnerabilities privately:
+
+- Email: `security@supaship.com`
+- Subject: `Security report - Supaship SDK`
+- Include: affected package, version, impact, and reproduction details
+
+Do not open public issues for suspected vulnerabilities.
+
+## Disclosure Process
+
+After acknowledgement, we will:
+
+1. Validate and triage the report
+2. Prepare and test a fix
+3. Publish patched versions
+4. Share a public advisory after remediation
diff --git a/packages/javascript/SECURITY.md b/packages/javascript/SECURITY.md
new file mode 100644
index 0000000..81f4145
--- /dev/null
+++ b/packages/javascript/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/javascript-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.
diff --git a/packages/javascript/package.json b/packages/javascript/package.json
index 4a3499a..23aa939 100644
--- a/packages/javascript/package.json
+++ b/packages/javascript/package.json
@@ -8,7 +8,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -48,5 +49,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }
diff --git a/packages/react/SECURITY.md b/packages/react/SECURITY.md
new file mode 100644
index 0000000..d97a0fa
--- /dev/null
+++ b/packages/react/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/react-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.
diff --git a/packages/react/package.json b/packages/react/package.json
index dc85785..72e65f9 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -20,7 +20,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -75,5 +76,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }
diff --git a/packages/vue/SECURITY.md b/packages/vue/SECURITY.md
new file mode 100644
index 0000000..93248cf
--- /dev/null
+++ b/packages/vue/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/vue-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.
diff --git a/packages/vue/package.json b/packages/vue/package.json
index 3599b8c..f34a6e6 100644
--- a/packages/vue/package.json
+++ b/packages/vue/package.json
@@ -15,7 +15,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -64,5 +65,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }