Document our security limitations

Alternative "fix" for #7.