when checking for security messages, check for word boundaries

in order to prevent "todos" match "dos" and other false positives
like this
bump 0.38.0