update docs

CHANGES.md

@@ -4,6 +4,7 @@ CHANGES
 ## 2.3.0-RC3
 
 * Feature: LDAP Authentication
+* Imprv: Prevent XSS
 * Fix: node versions couldn't be shown
 * Support: Upgrade libs
     * express-pino-logger
@@ -15,8 +16,6 @@ CHANGES
 * Fix: HeaderSearchBox didn't append 'q=' param when searching
     * Degraded by 2.2.3 updates
 
-* Feature: LDAP Authentication
-
 ## 2.2.3
 
 * Fix: The server responds anything when using passport

README.md

@@ -30,8 +30,8 @@ Why crowi-plus?
   * Adopt the fastest logger [pino](https://github.com/pinojs/pino)
   * Using CDN
 * **Secure**
-  * Upgrade jQuery to 3.x
-  * Upgrade other insecure libs
+  * Prevent XSS (Cross Site Scripting)
+  * Upgrade jQuery to 3.x and other insecure libs
   * The official Crowi status is [![dependencies Status](https://david-dm.org/crowi/crowi/status.svg)](https://david-dm.org/crowi/crowi) [![devDependencies Status](https://david-dm.org/crowi/crowi/dev-status.svg)](https://david-dm.org/crowi/crowi?type=dev)
 * **Convenient**
   * Support LDAP Authentication