fix .security.yml path in script