add security notes to README