Add warning about using pwned worker

diff --git a/README.md b/README.md
index 3e644308775476f79ba61733f4e92c61664c8123..b994ae3dae6e1ba0f3b218e71add09ca7b41a0f1 100644 (file)
--- a/README.md
+++ b/README.md
@@ -172,6 +172,12 @@ https://x.y.workers.dev?https://example.com
 
 ## pwned
 
+> [!CAUTION]<br> The underlying Pwned Passwords API used in this worker uses a
+> [_k_-anonymity model](https://en.wikipedia.org/wiki/K-anonymity) to preserve
+> your privacy. This worker negates that benefit. This worker should only be
+> referenced for education, not actually used in a production backend.<br><br>
+> [Click here to read more.](https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity)
+
 Checks a password against the [have i been pwned?](https://haveibeenpwned.com/)
 API and returns a boolean indicating if the password has been pwned or not. This
 is a simplified implementation of the