From c35f70d00eb32aff0c302c259fd15a30f67e9757 Mon Sep 17 00:00:00 2001
From: Thomas <28904802+UneBaguette@users.noreply.github.com>
Date: Sat, 18 Apr 2026 13:51:42 +0200
Subject: [PATCH] Add security section to README

Added a security note regarding the use of the blake3 Rust crate.
---
 README.md | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4a7ea4a..a95d8c2 100644
--- a/README.md
+++ b/README.md
@@ -56,8 +56,12 @@ Tested on **Ryzen 7 5800X**, Node.js v24.
 | 1 MB  | 51 MB/s       | 1,671 MB/s  | 1,893 MB/s  |
 | 10 MB | 51 MB/s       | 1,572 MB/s  | 1,812 MB/s  |
 
+## Security
+
+The underlying `blake3` Rust crate targets algorithmic constant time. However, the JavaScript boundary (via napi-rs or WASM) introduces non-determinism from the V8 runtime that is outside our control. For absolute security, use the `blake3` Rust crate directly in a Rust program.
+
 ## See also
 
 - [@noble/hashes](https://github.com/paulmillr/noble-hashes) | pure JS implementation
 - [awasm-noble](https://github.com/paulmillr/awasm-noble) | auditable WASM implementation
-- [blake3-napi](https://github.com/UneBaguette/blake3-napi)  | native Node.js addon, faster for large inputs
\ No newline at end of file
+- [blake3-napi](https://github.com/UneBaguette/blake3-napi)  | native Node.js addon, faster for large inputs