• Remove fluff text and get to the point: Report security flaws to
  [email protected]. Please do not disclose security flaws publicly
  until they have been handled by the security team.
• Fix somewhat confusing paragraph that says there are no "hard
  and fast rules" but then uses must in the context of a "general
  rule". Easiest solution seems to be to change must to should.
• Minor style change (you will instead of you'll)

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• documentation is changed or added
• commit message follows commit guidelines

Affected core subsystem(s)

doc