update doc after security changes.