Add a warning about the security hole :-(

diff --git a/README.md b/README.md
index 89869ae..213ecd3 100644 (file)
--- a/README.md
+++ b/README.md
@@ -1,3 +1,12 @@
+WARNING: THIS SOFTWARE IS UNSUPPORTED AND HAS A SECURITY PROBLEM - DO NOT USE WITHOUT MODIFICATION
+=========================================================================
+
+This code has a path traversal vulnerability, and needs updating to
+validate the new, stricter definition of the "kid" field (1-8 digits,
+not beginning '0'). **Do not use it** without fixing this issue. If
+you do fix this issue, please email raven-support@ucs.cam.ac.uk your
+patch ;-)
+
 University of Cambridge Classic ASP/VBScript Raven Authentication Module - v.1.0 (29/04/2014)
 ==========================================================================