security: make it clear about subtopics in server (#18754)

* security: make it clear about subtopics in server

* exclude DoS

Author: ngxson

SECURITY.md

@@ -38,7 +38,11 @@ Only vulnerabilities that fall within these parts of the project are considered
 - `src/**/*`
 - `ggml/**/*`
 - `gguf-py/**/*`
-- `tools/server/*` (note: Web UI is not covered)
+- `tools/server/*`, **excluding** the following topics:
+    - Web UI
+    - Features marked as experimental
+    - Features not recommended for use in untrusted environments (e.g., router, MCP)
+    - Bugs that can lead to Denial-of-Service attack
 
 Note that none of the topics under [Using llama.cpp securely](#using-llamacpp-securely) are considered vulnerabilities in LLaMA C++.