diff --git a/.github/funding.yaml b/.github/funding.yaml
new file mode 100644
index 0000000..6d41774
--- /dev/null
+++ b/.github/funding.yaml
@@ -0,0 +1 @@
+tidelift: npm/decode-uri-component
diff --git a/.github/security.md b/.github/security.md
new file mode 100644
index 0000000..5358dc5
--- /dev/null
+++ b/.github/security.md
@@ -0,0 +1,3 @@
+# Security Policy
+
+To report a security vulnerability, please use the [Tidelift security contact](https://tidelift.com/security). Tidelift will coordinate the fix and disclosure.