diff --git a/LICENSE b/LICENSE
index c392ede..75e6cdf 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,8 +1,6 @@
 BSD 3-Clause License
 
-Copyright (c) 2020 Tailscale & AUTHORS.
-Copyright (c) 2022 Weston Blieden (ACAP packaging and wrapper code)
-All rights reserved.
+Copyright (c) 2022, Weston Blieden
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
@@ -27,4 +25,10 @@ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
\ No newline at end of file
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+--------------------------------------------------------------------------------
+
+This distribution redistributes the Tailscale client (BSD 3-Clause,
+Copyright (c) 2020 Tailscale & AUTHORS). See THIRD_PARTY_NOTICES.md for the full
+attribution and license text.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d7bc756
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+# Security Policy
+
+This is an independent, community-developed ACAP package, provided on a
+best-effort basis. It is not an official Axis Communications product.
+
+## Reporting a vulnerability
+
+Please report security issues privately rather than in a public issue:
+
+- Use GitHub's "Report a vulnerability" (Security > Advisories) to open a
+  private advisory, or
+- email mblieden@gmail.com.
+
+Include the affected version (or `.eap` filename), camera model / Axis OS
+version, a description and its impact, and reproduction steps if available. You
+can expect an acknowledgement within a reasonable time; please avoid public
+disclosure until a fix is released.
+
+## Scope
+
+Reports about this ACAP's own wrapper code, configuration handling, and default
+settings are in scope. Vulnerabilities in bundled upstream projects should also
+be reported to their respective upstream projects.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
new file mode 100644
index 0000000..a21edb1
--- /dev/null
+++ b/THIRD_PARTY_NOTICES.md
@@ -0,0 +1,42 @@
+# Third-Party Notices
+
+This ACAP package redistributes the Tailscale client. The ACAP's own wrapper
+code is licensed separately (see `LICENSE`, BSD 3-Clause).
+
+## Tailscale
+
+- Copyright (c) 2020 Tailscale & AUTHORS
+- Project: https://github.com/tailscale/tailscale
+- License: BSD 3-Clause
+
+Tailscale is a product of Tailscale Inc. This package independently
+redistributes the Tailscale binaries and is not affiliated with, endorsed by, or
+supported by Tailscale Inc. For the official Tailscale client, visit
+https://tailscale.com.
+
+```
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+```