wrote a security design doc