README: on security