chore: Snyk CONTRIBUTING guidance (#171)

Author: cameronwaterman

CONTRIBUTING.md

@@ -92,6 +92,34 @@ pytest -m enterprise --enterprise-uri "https://test-api.lifecyclesolutions.ni.co
 It is important to note that depending on the terminal you are using,
 you may need to escape special characters in the API key.
 
+## Security scanning with Snyk
+
+This repository uses [Snyk](https://snyk.io/) for security scanning to identify and
+fix vulnerabilities in code before they reach production. Snyk provides Static
+Application Security Testing (SAST) that scans your code for security issues as
+you develop.
+
+- **IDE integration**: Install the Snyk extension for
+  [Visual Studio Code](https://marketplace.visualstudio.com/items?itemName=snyk-security.snyk-vulnerability-scanner)
+  or
+  [Visual Studio](https://marketplace.visualstudio.com/items?itemName=snyk-security.snyk-vulnerability-scanner-vs-2022)
+  to get real-time security feedback while writing code. To suggest the Snyk
+  extension to contributors, add `.vscode/extensions.json` or `.vsconfig` files
+  to your project root. The VSCode Snyk extension has a richer feature set and
+  is the preferred IDE for working with Snyk.
+- **Pull request scanning**: Snyk automatically scans PRs and posts comments for
+  high/critical vulnerabilities.
+- **Post-merge monitoring**: Automated bugs are created for unresolved issues
+  after code is merged.
+
+**Contributors within NI/Emerson**: For detailed guidance on working with Snyk,
+including how to address security issues and create ignore records, see the
+[Snyk reference](https://dev.azure.com/ni/DevCentral/_wiki/wikis/Stratus/146862/Snyk-reference).
+
+**Contributors outside of NI/Emerson**: If you are having issues resolving a
+vulnerability Snyk identifies on your PR, consult with a code owner to understand
+your options for resolution.
+
 ## Developer Certificate of Origin (DCO)
 
    Developer's Certificate of Origin 1.1