diff --git a/src/browser/security.txt b/src/browser/security.txt
new file mode 100644
index 000000000..18996f284
--- /dev/null
+++ b/src/browser/security.txt
@@ -0,0 +1,6 @@
+Contact: mailto:security@coder.com
+Acknowledgments: https://coder.com/security/thanks
+Preferred-Languages: en-US
+Canonical: https://coder.com/.well-known/security.txt
+Policy: https://coder.com/security/policy
+Hiring: https://coder.com/careers
\ No newline at end of file
diff --git a/src/node/routes/index.ts b/src/node/routes/index.ts
index a2046b6a7..96928493b 100644
--- a/src/node/routes/index.ts
+++ b/src/node/routes/index.ts
@@ -81,6 +81,13 @@ export const register = async (app: App, args: DefaultedArgs): Promise<Disposabl
       return res.redirect(`https://${req.headers.host}${req.originalUrl}`)
     }
 
+    // Return security.txt.
+    if (req.originalUrl === "/security.txt" || req.originalUrl === "/.well-known/security.txt") {
+      const resourcePath = path.resolve(rootPath, "src/browser/security.txt")
+      res.set("Content-Type", getMediaMime(resourcePath))
+      return res.send(await fs.readFile(resourcePath))
+    }
+
     // Return robots.txt.
     if (req.originalUrl === "/robots.txt") {
       const resourcePath = path.resolve(rootPath, "src/browser/robots.txt")