add security doc to index.html