Add security.md file.

## [6.3.12](v6.3.11...v6.3.12) (2022-01-24)

### Bug Fixes

* remove depreciation warning from log4js ([41bed33](41bed33))

Fixes #3751

## [6.3.13](v6.3.12...v6.3.13) (2022-01-31)

### Bug Fixes

* **deps:** bump log4js to resolve security issue ([5bf2df3](5bf2df3)), closes [#3751](#3751)

The `returnUrl` query parameter can be used to execute malicious code. For
example, visiting
`http://localhost:9876/?return_url=javascript:alert(document.domain)` will
display an alert.

Setting `singleRun` and `autoWatch` to `false` will not immediately run
anything. Warn the user about this.

It is incompatible with IE.

## [6.3.14](v6.3.13...v6.3.14) (2022-02-05)

### Bug Fixes

* remove string template from client code ([91d5acd](91d5acd))
* warn when `singleRun` and `autoWatch` are `false` ([69cfc76](69cfc76))
* **security:** remove XSS vulnerability in `returnUrl` query param ([839578c](839578c))