diff --git a/docs/Security.md b/docs/Security.md
index 60ca06f90..ef7f0608f 100644
--- a/docs/Security.md
+++ b/docs/Security.md
@@ -7,5 +7,16 @@ https://github.com/deskflow/deskflow/releases
 
 ## Reporting a Vulnerability
 
-Please report vulnerabilities on our issue tracker as bugs:
-https://github.com/deskflow/deskflow/issues
+Please report vulnerabilities privately, not on the public issue tracker.
+
+Use GitHub's private reporting form:
+https://github.com/deskflow/deskflow/security/advisories/new
+
+That opens a draft advisory only visible to maintainers. Include a proof of concept
+if you have one.
+
+## What happens next
+
+We land the fix on master, ship it in a continuous build, then publish the advisory
+and proof of concept together, so a fixed build is always available at the point the
+details go public. You will be credited in the advisory unless you ask otherwise.