add security documentation