Add security notice to CONTRIBUTING.md.
Finish up CONTRIBUTING.md.