Add security/ item to the wrapper, move existing CVE*txt there