clarify security (closes #520)