docs: note that self-hosting is optimized for single-tenant, trusted use

Document that self-hosting Trigger.dev is optimized for single-tenant
use with code and users you trust, and that it is not designed to run
untrusted code or untrusted payloads.

This adds a short note near the top of the self-hosting security docs
page and a matching Self-hosting section in SECURITY.md. Docs only, no
behavior changes.

Mono-RevId: 4f3ebc45fcd96ef0d5a204c760ba2e9a781c9513

Author: claude[bot]

SECURITY.md

@@ -2,6 +2,10 @@
 
 We take the security of Trigger.dev seriously — for both our Cloud service and self-hosted deployments. This document explains how to report a vulnerability and what to expect from us.
 
+## Self-hosting
+
+Unlike Trigger.dev Cloud, the self-hosted setup is optimized for single-tenant use, with code and users you trust. It is not designed to run untrusted code or untrusted payloads.
+
 ## Reporting a vulnerability
 
 **Please do not report security vulnerabilities through public GitHub issues, pull requests, or our Discord.**

docs/self-hosting/security.mdx

@@ -6,6 +6,11 @@ sidebarTitle: "Security"
 
 We take the security of Trigger.dev seriously, for both Cloud and self-hosted deployments. This page covers how to report a vulnerability, what to expect, and how to stay informed about security releases.
 
+<Note>
+  Unlike Trigger.dev Cloud, the self-hosted setup is optimized for single-tenant use, with code and
+  users you trust. It is not designed to run untrusted code or untrusted payloads.
+</Note>
+
 <Warning>
   Do not report security vulnerabilities through public GitHub issues, pull requests, or Discord. Use one of the private channels below.
 </Warning>