chore: improve security.md [ci skip]

diff --git a/SECURITY.md b/SECURITY.md
index ee59969f53302d3fdd99051d4db1413e1b3ab2f8..dac6018b5bc4b2450fd8907fca543bc9e7cd86d7 100644 (file)
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,3 +1,7 @@
 # Reporting a Vulnerability
 
-Please send vulnerability reports to: security@vuejs.org
+To report a vulnerability, please email security@vuejs.org.
+
+While the discovery of new vulnerabilities is rare, we also recommend always using the latest versions of Vue and its official companion libraries to ensure your application remains as secure as possible.
+
+Please note that we do not consider XSS via template expressions a valid attack vector, because it can only happen if the user intentionally uses untrusted content as template compilation source. This is similar to knowingly pasting untrusted scripts into a browser console. We explicitly warn users against using untrusted content as template compilation source in our documentation.