clarify

Author: Cristy

docs/script/security-policy.php/index.html

@@ -15,7 +15,7 @@ <h1 class="text-center">Security Policy</h1>
 
 <p>Keep in mind that what is considered reasonable for one environment may not be suitable for another. For example, you may have ImageMagick sandboxed in a secure environment, while someone else may use it to process images on a publicly accessible website. Or, ImageMagick may be running on a host with a lot of memory, while another instance is running on a device with limited resources. In the case of the host with large memory, it may make sense to allow large image processing, but not on the device with limited resources. If you are using ImageMagick on a public website, you may want to increase security by disabling certain coders such as MVG or HTTPS.</p>
 
-<p>To help you get started, as of version 6.9.12-94, ImageMagick provides security polices that you can select when installing ImageMagick.  ImageMagick’s security model is “everything allowed unless denied,” and the last matching policy wins.  Choose from:
+<p>To help you get started, as of version 6.9.12-94, ImageMagick provides security polices that you can select when installing ImageMagick.  ImageMagick’s security model is “everything allowed unless denied,” and the last matching policy wins.  Be careful when adding new rules: any later policy can override earlier denies or allows. Place broad deny rules first, followed by specific exceptions, and review ordering to avoid accidental authorization. Choose from:
 
 <ul>
 <dt><a href="/source/policy-open.xml">open</a></dt>