Add security issue reporting instructions (WordPress#4652)

CONTRIBUTING.md

@@ -63,3 +63,7 @@ If you'd like to contribute to the design or front-end, feel free to contribute
 Documentation is automatically synced from master to the [Gutenberg Documentation Website](https://wordpress.org/gutenberg/handbook/) every 15 minutes.
 
 To add a new documentation page, you'll have to create a Markdown file in the [docs](https://github.com/WordPress/gutenberg/tree/master/docs) folder and add an item to the [manifest file](https://github.com/WordPress/gutenberg/blob/master/docs/manifest.json).
+
+## Reporting Security Issues
+
+Please see [SECURITY.md](./SECURITY.md).

SECURITY.md

@@ -0,0 +1,5 @@
+# Reporting Security Issues
+
+The Gutenberg team and WordPress community take security bugs seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.
+
+To report a security issue, please visit the [WordPress HackerOne](http://hackerone.com/wordpress) program.