tagging security specs, exluding by default