Explicitly document the fact that “blacklist” doesn't prevent dependency loading and shouldn't be used for security