add client instruction to security_notes