security update in README