security update in README, as discussed