fix a vulerability, add some readme