Security overview

TODO: placeholder for the security section.

• Sandbox: what runs isolated, and what does not.

To report a vulnerability, follow the security policy in the project repository (SECURITY.md), not a public issue.