readme: fix security's list