Add security note

Author: ai

README.md

@@ -32,3 +32,12 @@ postcss(plugins).process(badCss, { parser: safe }).then(result => {
   result.css //= 'a {}'
 })
 ```
+
+
+## Security Contact
+
+To report a security vulnerability, please use the [Tidelift security contact].
+Tidelift will coordinate the fix and disclosure.
+
+[Tidelift security contact]: https://tidelift.com/security
+