There appears to be no way to understand what to do if there is a security bug, is it possible to add a policy to the security tab?