This is exactly right, thanks a bunch for checking. Also, thanks for the note! We will add a SECURITY.md