add security related docs (osa)