diff --git a/README.md b/README.md
index a58375c..1452976 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,8 @@
 ![](./img/logo.png)
 
-This is the PHP/webserver component for Lockbox. For instructions visit [the Lockbox app's main repository](https://git.openprivacy.ca/openprivacy/lockbox).
\ No newline at end of file
+This is the PHP/webserver component for Lockbox. For instructions visit [the Lockbox app's main repository](https://git.openprivacy.ca/openprivacy/lockbox).
+
+
+### Acknowledgements
+
+* thanks to Steve Weis (@sweis) for reporting a potential timing attack against admin password validation
\ No newline at end of file