Add note on unexpected exceptions to secuirty policy

Author: StanFromIreland

security/policy.rst

@@ -44,6 +44,8 @@ dead-locks, and resource exhaustion) must be
 triggerable with data inputs that are reasonably sized for the use case.
 Availability vulnerabilities must also demonstrate an "upward" change in posture
 for the attacker, rather than a "lateral" one.
+Unexpected Python exceptions are not vulnerabilities by themselves unless they
+satisfy the availability criteria above.
 This is to avoid handling performance improvements as security vulnerabilities.
 
 Vulnerabilities in dependencies of Python (such as zlib, Tcl/Tk, or OpenSSL)