diff --git a/doc/security/README.md b/doc/security/README.md
index 473f3632dcd..fba6013d9c1 100644
--- a/doc/security/README.md
+++ b/doc/security/README.md
@@ -4,4 +4,5 @@
 - [Rack attack](rack_attack.md)
 - [Web Hooks and insecure internal web services](webhooks.md)
 - [Information exclusivity](information_exclusivity.md)
-- [Reset your root password](reset_root_password.md)
\ No newline at end of file
+- [Reset your root password](reset_root_password.md)
+- [User File Uploads](user_file_uploads.md)
diff --git a/doc/security/user_file_uploads.md b/doc/security/user_file_uploads.md
new file mode 100644
index 00000000000..98493d33b00
--- /dev/null
+++ b/doc/security/user_file_uploads.md
@@ -0,0 +1,11 @@
+# User File Uploads
+
+Images attached to issues, merge requests or comments do not require authentication
+to be viewed if someone knows the direct URL. This direct URL contains a random
+32-character ID that prevents unauthorized people from guessing the URL to an
+image containing sensitive information. We don't enable authentication because
+these images need to be visible in the body of notification emails, which are
+often read from email clients that are not authenticated with GitLab, like
+Outlook, Apple Mail, or the Mail app on your mobile device.
+
+Note that non-image attachments do require authentication to be viewed.