diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog for `wai-saml2`
 
+## 0.7.1
+
+-   Fixed spelling of attribute `AllowCreate` in `NameIDPolicy` ([#88](https://github.com/mbg/wai-saml2/pull/88) by [@Philonous](https://github.com/Philonous))
+
 ## 0.7
 
 -   Replaced `x509Certificate` with `x509Certificates` in `IDPSSODescriptor` so that it may have more than one certificate ([#65](https://github.com/mbg/wai-saml2/pull/65) by [@fumieval](https://github.com/fumieval))
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -23,6 +23,8 @@
 
 * You __must not__ expose any errors to a client as that could severely compromise the security of the system as attackers may be able to use the errors to narrow down valid SAML responses. You __should__ log and monitor errors though as they may indicate attacks on your system. Ensure that log files containing errors from the SAML2 middleware are stored securely.
 
+See also [SECURITY.md](SECURITY.md) for information about this library's security policy, including how to report a vulnerability if you have discovered one.
+
 ## Usage
 
 ### Preliminaries
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you have discovered a vulnerability in this library, please [report it confidentially by creating a new security advisory for this repository on GitHub](https://github.com/mbg/wai-saml2/security/advisories/new). A [good template for reporting vulnerabilities](https://github.com/github/securitylab/blob/dc3f4357b72c2ed23020615117b431fe573b7134/docs/report-template.md) was put created by GitHub's Security Lab if you want to use it.
+
+When reporting a vulnerability, please try to include enough instructions to allow the issue to be recreated. Please also include information about the potential impact of the vulnerability, any pre-conditions that need to be met. If you have a suggested remediation, we would be thankful if you include it as well.
+
+If the vulnerability is confirmed, we will aim to fix it as soon as possible.
+
+Once fixed, the security advisory you filed will be published publicly and you will be credited.
diff --git a/src/Network/Wai/SAML2/Request.hs b/src/Network/Wai/SAML2/Request.hs
--- a/src/Network/Wai/SAML2/Request.hs
+++ b/src/Network/Wai/SAML2/Request.hs
@@ -144,7 +144,7 @@
         nameIdPolicy = Element
             (saml2pName "NameIDPolicy")
             (Map.fromList
-                [ ("allowCreate"
+                [ ("AllowCreate"
                     , if authnRequestAllowCreate then "true" else "false")
                 , ("Format", showNameIDFormat authnRequestNameIDFormat)
                 ])
diff --git a/wai-saml2.cabal b/wai-saml2.cabal
--- a/wai-saml2.cabal
+++ b/wai-saml2.cabal
@@ -1,11 +1,11 @@
-cabal-version: 1.12
+cabal-version: 1.18
 
--- This file has been generated from package.yaml by hpack version 0.38.1.
+-- This file has been generated from package.yaml by hpack version 0.39.6.
 --
 -- see: https://github.com/sol/hpack
 
 name:           wai-saml2
-version:        0.7.0
+version:        0.7.1
 synopsis:       SAML2 assertion validation as WAI middleware
 description:    A Haskell library which implements SAML2 assertion validation as WAI middleware
 category:       Security
@@ -19,7 +19,6 @@
 build-type:     Simple
 extra-source-files:
     README.md
-    CHANGELOG.md
     tests/data/azuread-signed-assertion.xml
     tests/data/azuread-signed-response.xml
     tests/data/azuread.crt
@@ -35,6 +34,9 @@
     tests/data/metadata/google.xml.expected
     tests/data/metadata/keycloak.xml
     tests/data/metadata/keycloak.xml.expected
+extra-doc-files:
+    CHANGELOG.md
+    SECURITY.md
 
 source-repository head
   type: git