I have removed the contact email for now. Having the system tell you it has potential security issues sounds like a bit of a security hole to me 
The hacker could have already compromised the system and disabled this, so I think it shouldn’t be the primary form of security notification, more a convenience.
Being able to disable the meta generator data that displays your Discourse version would be nice too. I’m not sure what benefits it provides, but it does leak information useful for hacking.
The best idea I have come up with adding the contact URL is by inserting HTML with DOM manipulation. That way you can leave the rest of the template as is. I don’t know if I will run into issues with that, because it seems emberjs can sometimes modify the code using a message bus. I am trying to figure out how to get jQuery working as mentioned here: https://meta.discourse.org/t/jquery-in-admin-custom-html/24253