Add security note about sanitizing raw queries