add more note on security