[security-dev] Where's requirements doc?