Add a section on Security to README. Explain how to keep creds out of VCS.