Add security caveat to README