From 3861a85cc5ef96b39e430fb31baa7f6a3cf45f35 Mon Sep 17 00:00:00 2001
From: teor <teor@riseup.net>
Date: Mon, 1 Feb 2021 10:59:30 +1000
Subject: [PATCH] Mention security disclosure policy in README

---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index c879e60c9..e9880511f 100644
--- a/README.md
+++ b/README.md
@@ -235,6 +235,10 @@ communication between stateful components is handled internally by
 [internal asynchronous RPC abstraction](https://docs.rs/tower/)
 ("microservices in one process").
 
+## Security
+
+Zebra has a [responsible disclosure policy](https://github.com/ZcashFoundation/zebra/blob/main/responsible_disclosure.md), which we encourage security researchers to follow.
+
 ## License
 
 Zebra is distributed under the terms of both the MIT license