minor fix on security.yml