Add notes on security

Author: wooorm

readme.md

@@ -44,6 +44,11 @@ scriptSupporting({
 
 Check if the given value is a [*script-supporting*][spec] [*element*][element].
 
+## Security
+
+`hast-util-script-supporting` does not change the syntax tree so there are no
+openings for [cross-site scripting (XSS)][xss] attacks.
+
 ## Contribute
 
 See [`contributing.md` in `syntax-tree/.github`][contributing] for ways to get
@@ -103,3 +108,5 @@ abide by its terms.
 [hast]: https://github.com/syntax-tree/hast
 
 [element]: https://github.com/syntax-tree/hast#element
+
+[xss]: https://en.wikipedia.org/wiki/Cross-site_scripting