diff --git a/README.md b/README.md
index 19e9cd7..7274953 100644
--- a/README.md
+++ b/README.md
@@ -28,3 +28,4 @@
 
 * The bot currently only supports JavaScript actions.
 * The bot will stop if the websocket connection is lost.
+* You must assume users of the bot will be able to gain access to the OpenWhisk credentials.