diff --git a/ChangeLog.d/security-advice.txt b/ChangeLog.d/security-advice.txt
new file mode 100644
index 0000000000..1f7677a882
--- /dev/null
+++ b/ChangeLog.d/security-advice.txt
@@ -0,0 +1,2 @@
+Security
+   * Added advice about compiler options in SECURITY.md.
diff --git a/SECURITY.md b/SECURITY.md
index e36162abd7..b485d0112e 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -107,6 +107,12 @@ model, they need to be mitigated by physical countermeasures.
 
 ### Caveats
 
+#### Compiler-induced side channels
+
+Mbed TLS is mostly written in C. We use standard C except with known compilers, so we do not expect compilers to introduce direct vulnerabilities. However, compilers can introduce [timing side channels](#timing-attacks) in code that was intended to be constant-time. Mbed TLS includes countermeasures to try to prevent this. But given the diversity of compilers, compiler options and target platforms, this prevention may not be complete.
+
+We recommend compiling Mbed TLS with commonly used levels of optimizations, such as `-O2` or `-Os`. We will generally treat exploitable timing side channels as a vulnerability if they appear with a common compiler at a common level of optimization. Higher levels of optimization such as `-O3` or `-Oz` are still likely to be safe but are less scrutinized. We do not recommend using individual options that might introduce data-dependent timing, and we will not try to work around such optimizations if they are not part of a commonly used level.
+
 #### Out-of-scope countermeasures
 
 Mbed TLS has evolved organically and a well defined threat model hasn't always