more security info in README