Add a rule for insufficient security on resources

If a resource is paid it is against the rules: