docs: fix README security policy

[pavan-sh]

Description

This PR fixes two one README issue:

Clarifies the Quick Start note about express-generator versioning: the generator’s major version indicates which Express major it targets (implication, not equality). Also
updates the “Security Issues” link to the stable security policy URL: https://github.com/expressjs/express/security/policy

Certificate of Origin

Signed-off-by: Pavan Shinde pavann97@gmail.com

[krzysdz]

The express-generator part is still true - major version X of generator uses Express version X. There is no generator 5 that would install Express 5, but using any existing version of generator won't install it either. Think of it as an implication instead of equality.

[pavan-sh]

The express-generator part is still true - major version X of generator uses Express version X. There is no generator 5 that would install Express 5, but using any existing version of generator won't install it either. Think of it as an implication instead of equality.

Good point — agreed (it’s an implication, not equality). I updated the wording to clarify that the generator’s major version indicates which Express major it targets, without implying that an Express major necessarily has a matching generator major.

[efekrskl]

Thanks for your contribution!

I'm failing to understand what this PR solves though, because it is just rephrasing at this point, no?

[pavan-sh]

Hi @krzysdz @efekrskl For now, just kept the security link Fix. Earlier it was broken and was not pointing to security docs. Removed the generator note to avoid confusion. Thanks for the review and your valuable time.