diff --git a/src/external/README.md b/src/external/README.md
new file mode 100644
index 0000000..dcb99d4
--- /dev/null
+++ b/src/external/README.md
@@ -0,0 +1 @@
+To harden Picocrypt dependency-wise, I have manually "forked" Picocrypt's dependencies and stored them here. If one of Picocrypt's dependencies gets compromised, Picocrypt would be using a secure copy of it, so there would be no security issue. All files in are are external and not written by me.