SECURITY.md: contributors must agree to confidentiality