Add note about server.scm probably being insecure

README.md

@@ -38,6 +38,11 @@ and use the system from there.
 cross-origin isolation headers required for `SharedMemoryBuffer` use.
 You could use any HTTP server that sets these headers.
 
+You should **definitely not** use the development server to serve the
+application on the open internet; I just hacked it together for
+testing on localhost during development and it's probably hilariously
+insecure.
+
 ## Peripherals
 
 ### Terminal