README: added security note