diff --git a/README.md b/README.md
index c230e6f9d..c5375060d 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,9 @@ and securely replicates it on many machines.
 
 For protocol details, see [the specification](/docs/spec).
 
+To report a security vulnerability, see our [bug bounty
+program](https://tendermint.com/security).
+
 ## Minimum requirements
 
 Requirement|Notes