diff --git a/README.md b/README.md
index 4a7ea4a..a95d8c2 100644
--- a/README.md
+++ b/README.md
@@ -56,8 +56,12 @@ Tested on **Ryzen 7 5800X**, Node.js v24.
 | 1 MB  | 51 MB/s       | 1,671 MB/s  | 1,893 MB/s  |
 | 10 MB | 51 MB/s       | 1,572 MB/s  | 1,812 MB/s  |
 
+## Security
+
+The underlying `blake3` Rust crate targets algorithmic constant time. However, the JavaScript boundary (via napi-rs or WASM) introduces non-determinism from the V8 runtime that is outside our control. For absolute security, use the `blake3` Rust crate directly in a Rust program.
+
 ## See also
 
 - [@noble/hashes](https://github.com/paulmillr/noble-hashes) | pure JS implementation
 - [awasm-noble](https://github.com/paulmillr/awasm-noble) | auditable WASM implementation
-- [blake3-napi](https://github.com/UneBaguette/blake3-napi)  | native Node.js addon, faster for large inputs
\ No newline at end of file
+- [blake3-napi](https://github.com/UneBaguette/blake3-napi)  | native Node.js addon, faster for large inputs