add documentation about a possible security issue