docs: add note about security report location