Update the SECURITY.txt document. Clarify what is meant by a "direct compromise of security", emphasise that the tools do not provide a sevrice of any kind, and show that bugs that rely upon untrusted input must be able to cross a trust boundary in order to be considered as a security issue.