diff --git a/readme.md b/readme.md
index 60f4ae9..55800fc 100644
--- a/readme.md
+++ b/readme.md
@@ -80,6 +80,21 @@ The update check is done in a unref'ed [child process](https://nodejs.org/api/ch
 The first time the user runs your app, it will check for an update, and even if an update is available, it will wait the specified `updateCheckInterval` before notifying the user. This is done to not be annoying to the user, but might surprise you as an implementer if you're testing whether it works. Check out [`example.js`](example.js) to quickly test out `update-notifier` and see how you can test that it works in your app.
 
 
+---
+
+<div align="center">
+	<b>
+		<a href="https://tidelift.com/subscription/pkg/npm-update_notifier?utm_source=npm-update-notifier&utm_medium=referral&utm_campaign=readme">Get professional support for this package with a Tidelift subscription</a>
+	</b>
+	<br>
+	<sub>
+		Tidelift helps make open source sustainable for maintainers while giving companies<br>assurances about security, maintenance, and licensing for their dependencies.
+	</sub>
+</div>
+
+---
+
+
 ## API
 
 ### notifier = updateNotifier(options)
@@ -189,6 +204,11 @@ There are a bunch projects using it:
 [And 1600+ more…](https://www.npmjs.org/browse/depended/update-notifier)
 
 
+## Security
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.
+
+
 ## License
 
 BSD-2-Clause © Google