Adding a security policy to an unrelated repository is easily missed and questionably applicable.