moved security.yml to conf.d/