diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..10667993e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,27 @@
+# Security policy
+
+## Scope
+
+- The one-line installer: `install.sh`, `install.ps1` and the `install.py` they download.
+- The packs, their manifests under `install/` and the checksums each release publishes.
+- The website, its scripts and the data it serves under `api/`.
+
+## Reporting a vulnerability
+
+Report it privately from the repository's **Security** tab, with **Report a vulnerability**. A public issue is the wrong place for it: the details stay private until a fix is out.
+
+A useful report names the file or the page, the steps that show the problem, and what an attacker gains.
+
+## Supported versions
+
+The installer and the site served from `main`, and the latest release. Older releases are removed when a new one is published.
+
+## How downloads are checked
+
+- `install.sh` and `install.ps1` download `install.py` from a fixed commit and refuse it unless its SHA-256 matches the one they carry.
+- The installer checks every file against the hash its manifest records before writing it.
+- Each release lists the SHA-256 of its files in `SHA256SUMS.txt`, signed with the key in `allowed_signers`: [verifying a release](https://abdess.github.io/retrobios/wiki/release-process/#verifying-a-release).
+
+## Not a security issue
+
+A file with an unexpected hash, a missing file or a takedown request: [open an issue](https://github.com/Abdess/retrobios/issues/new) with the file's path or hash.
diff --git a/wiki/what-are-bios-files.md b/wiki/what-are-bios-files.md
index 985839f42..60fd35b65 100644
--- a/wiki/what-are-bios-files.md
+++ b/wiki/what-are-bios-files.md
@@ -8,7 +8,7 @@ order: 10
 A console has a small program inside it. It starts first, then starts the game.
 This program is the **BIOS**, also called **firmware**.
 
-<a class="rb-button rb-button-primary" href="../which-pack.md">Get your files</a>
+<a class="rb-button rb-button-primary" href="../which-pack.md">Get the files</a>
 
 An **emulator** is an app that acts like a console. For many consoles, it needs
 a copy of the BIOS. That copy is a file: a **BIOS file**.
@@ -17,14 +17,14 @@ a copy of the BIOS. That copy is a file: a **BIOS file**.
 
 ## How it works
 
-1. You pick a game in your setup's menu.
+1. Pick a game in the setup's menu.
 2. The setup starts the emulator.
-3. The emulator opens the BIOS file in your **BIOS folder**.
+3. The emulator opens the BIOS file in the **BIOS folder**.
 4. The game starts.
 
-If step 3 fails, you see "BIOS missing" or a black screen.
+If step 3 fails, the screen says "BIOS missing" or stays black.
 
-## Do I need one?
+## Which consoles need one? { #do-i-need-one }
 
 - **Yes:** PlayStation 1 and 2, Saturn, Neo Geo, PC Engine CD and many home
   computers.
@@ -49,12 +49,12 @@ another for Europe.
 Some setups check each file's **hash**, a fingerprint of its contents.
 Batocera, Recalbox and EmuDeck report a version they do not expect.
 
-Our files are the versions each setup expects.
+The files here are the versions each setup expects.
 
 ## Can a game start without it?
 
 Sometimes. Some emulators carry their own code in place of the BIOS. Some games
-then glitch or do not start. The real file works best, so we include it.
+then glitch or do not start. The real file works best, so the packs include it.
 
 ## Is it legal?
 
@@ -62,6 +62,6 @@ Laws differ by country. [Is it legal?](legal.md)
 
 ## Next steps
 
-- [Get your files](../which-pack.md)
+- [Get the files](../which-pack.md)
 - [Words used on this site](glossary.md)