SECURITY.md

Security policy

To report sensitive vulnerability information, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.