added security design doc