In physical-layer security, secrecy capacity is an important performance metric. This work aims to determine the secrecy capacity for an indoor visible light communication system consisting of a transmitter, a legitimate receiver and an eavesdropping receiver. In such a system, both signal-independent noise and signal-dependent noise are considered. Under nonnegativity and average optical intensity constraints, lower and upper bounds on secrecy capacity are derived by the variational method, the dual expression of the secrecy capacity, and the concept of “the optimal input distribution that escapes to infinity”. By an asymptotic analysis at large optical intensity, there is a small gap between the asymptotic upper and lower bounds. Then, by adding a peak optical intensity constraint, we further analyze the exact and asymptotic secrecy-capacity bounds. For practical considerations, the effects of imperfect channel state information, multi-photodiode eavesdropper, and artificial noise on secrecy performance are also discussed. Finally, the derived secrecy-capacity bounds are verified by numerical results.