Security policy will be part of the next release. See draft RFC [1], although note it's likely not going to be the final syntax.

[1] https://github.com/edgedb/rfcs/blob/865bc48f4050ced99447bd77...