diff --git a/Security.md b/Security.md
index e69de29..9113828 100644
--- a/Security.md
+++ b/Security.md
@@ -0,0 +1,21 @@
+# Security
+
+## Risk Profile
+
+- Hardware/firmware changes can affect physical devices; releases need board verification, recovery notes, and checksums.
+- Security-sensitive repository; documentation is scoped to authorized lab, defensive, or research use.
+- NFC/RFID work must not store card dumps, keys, or personal credential material.
+
+## Handling Rules
+
+- Do not commit credentials, tokens, cookies, keys, private logs, captures, card data, or personal data.
+- Keep generated dependency trees, copied SDKs, and build output out of Git unless explicitly documented as source.
+- For security-sensitive projects, keep docs scoped to authorized lab, research, or defensive maintenance.
+- Treat unknown-origin binaries as blocked until provenance is recorded.
+
+## Review Checklist
+
+- [ ] Search the repository for secrets and private data.
+- [ ] Confirm dependency sources and upstream license status.
+- [ ] Confirm generated artifacts are ignored or moved to releases.
+- [ ] Confirm project-specific safe-use boundaries are written in README and release notes.