vendor security