small security note in README