I completely forgot about this PR until some random AI agent found a "security issue".
Not being sure it applies to this scenario and too lazy to verify, sometimes the security scanners get updated and flag previously accepted code.
... tough to make sense of flagging a readme though, unless there's sensitive info in it.