mention autopublish and insecure packages