diff --git a/CHANGELOG.md b/CHANGELOG.md
index 78718ef..5764545 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Documentation
+
+- Correct `SECURITY.md`: fix the reporting contact address and replace the
+  scope section, which described an unrelated static-site generator, with the
+  YAML parsing, validation, and emitting surface that is actually in scope.
+
 ## [0.1.5] - 2026-06-23
 
 ### Documentation
diff --git a/SECURITY.md b/SECURITY.md
index 0ac3613..6310997 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -5,7 +5,7 @@
 If you believe you have found a security issue in PureYAML, please report it
 privately. Do not open a public issue for security problems.
 
-Email **mihaelamj.com** with:
+Email **mihaelamj@gmail.com** with:
 
 - A description of the issue and its impact.
 - Steps to reproduce, or a proof of concept.
@@ -23,6 +23,13 @@ supported.
 
 ## Scope
 
-PureYAML generates static sites. The generated output is plain HTML, CSS, and
-client-side JavaScript for rich tiles. Reports about generated output (for
-example, missing output escaping that enables script injection) are in scope.
+PureYAML parses, validates, and emits YAML. Reports about how the library
+handles untrusted input are in scope, for example:
+
+- Malformed or adversarial input that causes a crash, an unbounded loop, stack
+  overflow, or excessive memory or CPU use.
+- Parser or emitter behavior that misrepresents input in a way a consumer could
+  rely on for a security decision (for example, a value that round-trips to a
+  different meaning).
+- Incorrect rejection or acceptance of input by the validation layer that a
+  consumer treats as a trust boundary.