Add information on reporting security issues

Signed-off-by: Jeremy Katz <jeremy@tidelift.com>

.github/SECURITY.md

@@ -0,0 +1,5 @@
+# Security
+
+Rancher Labs supports responsible disclosure and endeavors to resolve security
+issues in a reasonable timeframe. To report a security vulnerability, email
+[security@rancher.com](mailto:security@rancher.com)

README.md

@@ -145,3 +145,8 @@ Contributing
 ------------
 
 Please check out our [contributing guide](CONTRIBUTING.md) if you're interesting in contributing to k3s.
+
+Security
+--------
+
+Security issues in k3s can be reported by sending an email to [security@rancher.com](mailto:security@rancher.com). Please do not file issues about security issues.