diff --git a/static_src/elements/framework/mr-vulnz-banner/mr-vulnz-banner.js b/static_src/elements/framework/mr-vulnz-banner/mr-vulnz-banner.js
new file mode 100644
index 0000000..959e163
--- /dev/null
+++ b/static_src/elements/framework/mr-vulnz-banner/mr-vulnz-banner.js
@@ -0,0 +1,67 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import {LitElement, html, css} from 'lit-element';
+
+import {connectStore} from 'reducers/base.js';
+import * as projectV0 from 'reducers/projectV0.js';
+import * as sitewide from 'reducers/sitewide.js';
+
+const OLD_VULNZ_URL = "https://vulnz.avm99963.com/";
+
+/**
+ * `<mr-vulnz-banner>`
+ *
+ * A banner for the Vulnz project to state where old vulnerability
+ * reports can be found.
+ *
+ */
+export class MrVulnzBanner extends connectStore(LitElement) {
+  /** @override */
+  static get styles() {
+    return css`
+      :host([hidden]) {
+        display: none;
+      }
+      :host {
+        display: block;
+        font-weight: bold;
+        color: var(--chops-black);
+        background: var(--chops-primary-accent-bg);
+        padding: 5px;
+        text-align: center;
+      }
+    `;
+  }
+
+  /** @override */
+  render() {
+    return html`Much older vulnerability reports can be found at
+      <a href="${OLD_VULNZ_URL}">${OLD_VULNZ_URL}</a>.`;
+  }
+
+  /** @override */
+  static get properties() {
+    return {
+      hidden: {
+        type: Boolean,
+        reflect: true,
+      },
+    };
+  }
+
+  /** @override */
+  constructor() {
+    super();
+
+    this.hidden = true;
+  }
+
+  /** @override */
+  stateChanged(state) {
+    this.hidden = projectV0.viewedProjectName(state) !== 'vulnz';
+  }
+}
+
+customElements.define('mr-vulnz-banner', MrVulnzBanner);
diff --git a/static_src/elements/mr-app/mr-app.js b/static_src/elements/mr-app/mr-app.js
index 8fe3dad..7c7e002 100644
--- a/static_src/elements/mr-app/mr-app.js
+++ b/static_src/elements/mr-app/mr-app.js
@@ -9,6 +9,7 @@
 
 import {getServerStatusCron} from 'shared/cron.js';
 import 'elements/framework/mr-site-banner/mr-site-banner.js';
+import 'elements/framework/mr-vulnz-banner/mr-vulnz-banner.js';
 import {store, connectStore} from 'reducers/base.js';
 import * as projectV0 from 'reducers/projectV0.js';
 import {hotlists} from 'reducers/hotlists.js';
@@ -85,6 +86,7 @@
         .logoutUrl=${this.logoutUrl}
       ></mr-header>
       <mr-site-banner></mr-site-banner>
+      <mr-vulnz-banner></mr-vulnz-banner>
       <mr-cue
         cuePrefName=${cueNames.SWITCH_TO_PARENT_ACCOUNT}
         .loginUrl=${this.loginUrl}