Merge pull request #536 from DuendeSoftware/leastprivilege-patch-2

Update security.md

IdentityServer/v7/docs/content/overview/security.md

@@ -49,7 +49,7 @@ Our products are off-the shelf downloadable developer components. They are not m
 * Potential security vulnerabilities can be responsibly disclosed via our [contact form](https://duendesoftware.com/contact).
    * We guarantee to reply within two US business days.
 * All licenses includes a security notification service.
-   * Whenever a security vulnerability has been confirmed and fixed, customers will get a private update prior to public release.
+   * Whenever a medium severity or higher security vulnerability has been confirmed and fixed, customers will get a private update prior to public release.
 * We will publish an official advisory
 
 ### Dependencies