Add security contact information

Tidelift will coordinate the vulnerability and the fix with the tox
team.

Author: jugmac00

README.md

@@ -23,3 +23,8 @@ tox is a generic virtual environment management and test command line tool you c
 Please read our [user guide](https://tox.wiki/en/latest/user_guide.html#basic-example) for an example and more detailed
 introduction, or watch [this YouTube video](https://www.youtube.com/watch?v=SFqna5ilqig) that presents the problem space
 and how tox solves it.
+
+## Security contact information
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift
+will coordinate the fix and disclosure.