Add note about reporting security issues

As recommended by @drogus