Update doc/development/fe_guide/security.md

doc/development/fe_guide/security.md

@@ -105,3 +105,9 @@ element.appendChild(sanitize(unsafeHtml));
 
 This `sanitize` function takes the same configuration as the
 original.
+
+### Fixing Security Issues
+
+When refactoring old code, it's important that we don't accidentally remove specs written to catch security issues.
+
+We should mark specs with `#security` in either the `describe` or `it` blocks to communicate to the engineer reading the code that by removing these specs could have severe consequences down the road, and you are removing code that could catch a reintroduction of a security issue.