note in readme about security