docs: add more notes on security