Post #1860144

@sethmlarson @davidism Even a link might be sufficient. These scanning tools tend to be very repo-oriented right now. Taking Flask as an example, I'd personally probably get to the security policy via the link to the contribution guide, but smacking people in the face more obviously with a SECURITY.md or update to the README — even if it's just a link — might improve the signal:noise.