Add security disclosure to readme.md

Author: pfista

Diff for: README.md

@@ -65,6 +65,10 @@ We'd love your help making Nylas better! Please sign-up for a [developer account
 
 We require all authors sign our [Contributor License Agreement](https://www.nylas.com/cla.html) when submitting pull requests. (It's similar to other projects, like NodeJS or Meteor.)
 
+## Security
+
+For the sake of simplicity and setup speed, the development VM does not include any authentication or permission. For developing with sensitive data, we encourage developers to add their own protection, such as only running Nylas on a local machine or behind a controlled firewall.
+Note that passwords and OAuth tokens are stored unencrypted in the local MySQL data store on disk. This is intentional, for the same reason as above.
 
 ## License