diff --git a/doc/design/assistant/telehash.mdwn b/doc/design/assistant/telehash.mdwn
index ad692a4d12..b9755736f3 100644
--- a/doc/design/assistant/telehash.mdwn
+++ b/doc/design/assistant/telehash.mdwn
@@ -9,6 +9,8 @@ git-annex (assistant) repositories.
   telehash v1 (even that seems incomplete). I have pinged its author
   to see if he anticipates updating it.
 * Rapid development, situation may change in a month or 2.
+* Is it secure? A security review should be done by competant people
+  (not Joey). See <https://github.com/telehash/telehash.org/issues/23>
 
 ## implementation basics