add link to our security mailing list

Doug Davis · Doug Davis · commit ac3d30cd50aa · 2023-10-17T13:00:27.000Z
Signed-off-by: Doug Davis &lt;dug@microsoft.com&gt;
diff --git a/README.md b/README.md
@@ -153,6 +153,10 @@ for how PR reviews and approval, and our
 [Code of Conduct](https://github.com/cloudevents/spec/blob/master/community/GOVERNANCE.md#additional-information)
 information.
 
+If there is a security concern with one of the CloudEvents specifications, or
+with one of the project's SDKs, please send an email to
+[cncf-cloudevents-security@lists.cncf.io](mailto:cncf-cloudevents-security@lists.cncf.io).
+
 ## Additional SDK Resources
 
 - [List of current active maintainers](MAINTAINERS.md)
