Add security docs. They're a bit science-fictiony at the moment and
I need to adjust the actual code to follow it.