Add section on reporting security vulnerabilities through Tidelift.

1 files changed, 4 insertions, 0 deletions

diff --git a/README.rst b/README.rst
index bfbaaad8..dac8a468 100644
--- a/README.rst
+++ b/README.rst
@@ -29,6 +29,10 @@ Bug reports and especially tested patches may be
 submitted directly to the `bug tracker
 <https://github.com/pypa/setuptools/issues>`_.
 
+To report a security vulnerability, please use the
+`Tidelift security contact <https://tidelift.com/security>`_.
+Tidelift will coordinate the fix and disclosure.
+
 
 Code of Conduct
 ---------------