Add some basic security guidance
Add security step to PR guidelines