docs: Add Security comments (SSRF) #672

	name: CI
	on: [push, pull_request]
	jobs:
	build:
	if: github.event_name == 'push' \|\| github.event.pull_request.head.repo.full_name != github.repository
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: pip
	cache-dependency-path: '*/requirements.txt'
	- run: pip install -r requirements.txt
	# Check requirements.txt contains production requirements.
	- run: ./manage.py --help
	- run: pip install -r requirements_dev.txt
	- name: Install gettext
	run: \|
	sudo apt update
	sudo apt install gettext
	- run: ./manage.py compilemessages
	- run: ./manage.py collectstatic --noinput -v2
	- name: Run checks and tests
	env:
	PYTHONWARNINGS: error
	shell: bash
	# https://github.com/OpenDataServices/flatten-tool/pull/458
	# https://github.com/OpenDataServices/flatten-tool/issues/412
	run: \|
	./manage.py migrate
	./manage.py makemigrations --check --dry-run
	./manage.py check --fail-level WARNING
	coverage run --source=core,cove_ocds -m pytest -W error -W ignore::DeprecationWarning:ijson.compat -W ignore::ResourceWarning
	- uses: coverallsapp/github-action@v2

Provide feedback