If these are the literal values, use quotes: "security", "bugfix", etc. Also, use the serial comma after the "and".