security: fix return types in documentation