Added security considerations from manifest spec (closes #11)