Add security contact information to Hug README

README.md

@@ -418,6 +418,16 @@ bash-4.3# tree
 1 directory, 3 files
 ```
 
+Security contact information
+===================
+
+Hug takes security and quality seriously. This focus is why we depend only on thoroughly tested components and utilize static analysis tools (such as bandit and safety) to verify the security of our code base.
+If you find or encounter any potential security issues, please let us know right away so we can resolve them.
+
+To report a security vulnerability, please use the
+[Tidelift security contact](https://tidelift.com/security).
+Tidelift will coordinate the fix and disclosure.
+
 Why hug?
 ===================