diff --git a/docs/src/pages/security.mdx b/docs/src/pages/security.mdx
index 2dbdf75bc0..54abae923e 100644
--- a/docs/src/pages/security.mdx
+++ b/docs/src/pages/security.mdx
@@ -7,6 +7,10 @@ response policy to ensure we responsibly handle critical issues.
 
 ## Reporting a Security Bug
 
+- Before reporting a suspected security issue, make sure to read the documentation on OPA's
+  [security](https://www.openpolicyagent.org/docs/security) model. Attack vectors that depend on the OPA server running
+  without authentication/authorization enabled will not be considered, as none of OPAs APIs are protected at that point.
+
 - If you think you have found a security issue in an OPA project, please send an email to
   [open-policy-agent-security@googlegroups.com](mailto:open-policy-agent-security@googlegroups.com).
   This list is delivered to a small security team. We will then acknowledge receipt of your report and prioritize initial analysis of severity.