add note on security