diff --git a/SECURITY.md b/SECURITY.md
index 3887026381..66bf440995 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -6,7 +6,7 @@ Please report security vulnerabilities by emailing: responsible.disclosure@proce
 
 ### Reporting Channels
 
-1. Security Advisories in a specific repository are received by p5.js admins/maintainers
+1. Security Advisories in this repository are received by p5.js admins/maintainers. To open one, go to https://github.com/processing/p5.js-web-editor/security/advisories/new
 2. Responsible Disclosure email reports are received by Processing Foundation staff
 
 ## What to Expect
@@ -25,6 +25,10 @@ Please report security vulnerabilities by emailing: responsible.disclosure@proce
 
 You can use the above email to report vulnerabilities in p5.js and related repositories managed by the processing org, including the reference website.
 
+## Threat Model
+
+The [Security Handbook](https://p5js.org/contribute/security_handbook/) documents the threat model shared by the p5.js library, website, and editor, including security advice for users and sketch authors. Its source is in [contributor_docs/security_handbook.md](https://github.com/processing/p5.js/blob/main/contributor_docs/security_handbook.md).
+
 ## Accidental Disclosure: Never Share Vulnerabilities Publicly!
 
 Please do not report security vulnerabilities in a public channel. If you notice a vulnerability being disclosed in a public channel (whether on Discord, the forum, GitHub, or other platforms), please flag it to a moderator immediately.