diff --git a/SECURITY.md b/SECURITY.md
index a9094fb0bb9624122795f236632f41c5a35d2475..94606b41d7f1a0809fa4a6cb80a65ee6da5d0d24 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,9 +2,10 @@
 
 ## Supported Versions
 
-The following matrix shows the versions currently maintained by the
-TYPO3 Community. Sprint releases (versions before 12.4.0 and 11.5.0,
-in their corresponding branches) are neither maintained nor supported.
+The following matrix shows the TYPO3 versions currently maintained by the TYPO3
+community. Sprint releases (versions before 12.4.0 and 11.5.0, in their
+corresponding branches) have reached their end of support and don't receive any
+further bug fixes or security patches.
 
 | Version  | Supported          |
 |----------|--------------------|
@@ -18,40 +19,52 @@ in their corresponding branches) are neither maintained nor supported.
 
 ## Reporting a Vulnerability
 
-Please report possible vulnerabilities to [security@typo3.org](mailto:security@typo3.org)
+Please report vulnerabilities to [security@typo3.org](mailto:security@typo3.org).
+Your report should include the following details:
 
-* Name the affected project (either TYPO3 Core or a TYPO3 extension/plugin)
-* Name the exact version or version range that has been analysed
-* Provide a step-by-step description of how to exploit the potential vulnerability
+* The affected project (either the TYPO3 Core or a TYPO3 extension).
+* The exact version or version range that you analysed.
+* A step-by-step explanation of how to exploit the potential vulnerability.
 
-### Coordinated Disclosure
+You can use the following GPG/PGP key ID to optionally encrypt your messages to
+[security@typo3.org](mailto:security@typo3.org):
 
-The [TYPO3 Security Team](https://typo3.org/community/teams/security) will
-coordinate with core mergers or corresponding extension/plugin maintainers and
-other affected parties. When a security fix is ready, we will package new
-releases and announce the fix to the public using various communication channels like:
+* Key ID: `C05FBE60`
+* Fingerprint: `B41C C3EF 373E 0F5C 7018  7FE9 3BEF BD27 C05F BE60`
+
+You can download the public key from the following sources:
+
+* [typo3.org](https://typo3.org/fileadmin/t3o_common_storage/keys/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60.asc)
+* [keys.openpgp.org](https://keys.openpgp.org/vks/v1/by-fingerprint/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60)
+
+## Coordinated Disclosure
+
+> :warning: We urge security researchers not to publish vulnerabilities in issue trackers or
+discuss them publicly (e.g. on Slack or Twitter).
+
+The [TYPO3 Security Team](https://typo3.org/community/teams/security) coordinates
+the process with the TYPO3 core developers, extension maintainers and other
+affected parties. Once a security fix is available, we prepare a new release and
+publish the fixed version. At the same time, we communicate the vulnerability and
+the fix to the public by using various communication channels such as:
 
 * [TYPO3 Security Advisories](https://typo3.org/help/security-advisories)
 * [TYPO3 Security Team on Twitter](https://twitter.com/typo3_security)
 * [#announce channel on Slack](https://typo3.org/community/meet/how-to-use-slack-in-the-typo3-community)
-* [TYPO3 Announce Mailing List](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce)
-
-The TYPO3 Security Team is taking care of requesting CVE IDs (common vulnerability and exposer identifiers).
-Please do not post or publish vulnerabilities to public issue trackers or discuss them on Slack or Twitter.
+* [TYPO3 Announce Mailing List](https://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce)
 
-### Message Encryption
+The TYPO3 Security Team takes care of requesting [CVE IDs](https://www.cve.org/About/Process#CVERecordLifecycle)
+(Common Vulnerabilities and Exposures identifiers).
 
-It is possible to send GPG/PGP encrypted emails to [security@typo3.org](mailto:security@typo3.org) using key id
-`C05FBE60` (complete fingerprint `B41C C3EF 373E 0F5C 7018  7FE9 3BEF BD27 C05F BE60`):
+## TYPO3 Release Dates ("Patchday")
 
-* download [public key file from typo3.org](https://typo3.org/fileadmin/t3o_common_storage/keys/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60.asc)
-* download [public key file from keys.openpgp.org](https://keys.openpgp.org/vks/v1/by-fingerprint/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60)
+We aim to publish TYPO3 maintenance releases on Tuesdays as a general rule.
+However, exceptions apply (e.g. public holidays). Release dates of
+[maintenance releases](https://typo3.org/cms/roadmap/maintenance-releases)
+are scheduled in advance. These releases can contain security fixes.
 
-## TYPO3 Release Dates / "Patchday"
+## Further Information
 
-TYPO3 releases (including possible security fixes) are usually published
-on Tuesdays (except on holidays like Christmas or New Year).
-
-The [Maintenance Releases](https://typo3.org/cms/roadmap/maintenance-releases)
-for stable versions have been scheduled in advance - it is very likely that
-security fixes will also be released on these dates.
+* [TYPO3 Security Team](https://typo3.org/community/teams/security)
+* [TYPO3 Security Advisories](https://typo3.org/help/security-advisories)
+* [TYPO3 Security Guidelines](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Security/Index.html)