Add README note about security reporting process.

Signed-off-by: Matthew Heon <mheon@redhat.com>

README.md

@@ -35,6 +35,9 @@ This project tests all builds against each supported version of Fedora, the late
 
 ## Communications
 
+If you think you've identified a security issue in the project, please *DO NOT* report the issue publically via the Github issue tracker, mailing list, or IRC.
+Instead, send an email with as many details as possible to `security@lists.podman.io`. This is a private mailing list for the core maintainers.
+
 For general questions and discussion, please use the
 IRC `#podman` channel on `irc.freenode.net`.