docs(security): add security doc