diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..8d523f5
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,7 @@
+## Security
+
+Please report any security issue to [https://www.sfdc.co/SubmitVuln](https://www.sfdc.co/SubmitVuln)
+as soon as it is discovered. This library limits its runtime dependencies in
+order to reduce the total cost of ownership as much as can be, but all consumers
+should remain vigilant and have their security stakeholders review all third-party
+products (3PP) like this one and their dependencies.
\ No newline at end of file
diff --git a/src/commands/data/setup/transfer.ts b/src/commands/data/setup/transfer.ts
index b4982ee..e72f537 100644
--- a/src/commands/data/setup/transfer.ts
+++ b/src/commands/data/setup/transfer.ts
@@ -1,5 +1,6 @@
 /*
  * Copyright 2026, Salesforce, Inc.
+ * SPDX-License-Identifier: Apache-2
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.