update readme to reflect directory traversal