* document security limitations

* minor issue description revisions + formatting

* Update security.md

* move CVEs description into separate document
Co-authored-by: Matt Hamilton <matt@soluble.ai>
Co-authored-by: Ed Lee <edlee2121@users.noreply.github.com>