docs: Add security vulnerability disclosure instructions to the Readme (#1283)

Author: doug-wade

Readme.md

@@ -204,6 +204,12 @@ the general Koa guide.
 $ npm test
 ```
 
+## Reporting vulnerabilities
+
+To report a security vulnerability, please do not open an issue, as this notifies attackers
+of the vulnerability. Instead, please email [dead_horse](mailto:[email protected]) and [jonathanong](mailto:[email protected]) to
+disclose.
+
 ## Authors
 
 See [AUTHORS](AUTHORS).