security policy update

You may have missed