Funny thing is I've seen this same typo (security spelled with a missing "c") first hand when reporting a security incident. What made it particularly bad was that it was a mailto:// link that was also spelled wrong so clicking it would send the email to the wrong address with no bounce reply (I'm guessing they had a catch all inbox rather than bouncing bad addresses).

Might want to throw in there a suggestion to generate a security@example.com GPG key and instructions to use it if the submitter feels it warrants it. Also, the usual note of not losing the private half of the GPG key so you don't look like an ass when someone emails you an encrypted security incident that you cannot decrypt!