docs(security): add security doc

WIP