apply feedback

README.md

@@ -39,6 +39,14 @@ console.log("Explorer mounted at localhost:" + port + "/explorer");
 app.listen(port);
 ```
 
+## swagger-ui vulnerabilities
+
+Regarding the security vulnerability on one of our dependencies `swagger-ui`: https://www.npmjs.com/advisories/985
+
+> Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.
+
+LoopBack's API Explorer does not allow clients to import swagger spec from YAML URL/pasted-content. That means loopback-component-explorer **IS NOT AFFECTED** by this vulnerability. For more details, see discussion in https://github.com/strongloop/loopback-component-explorer/issues/263#issuecomment-529385166. 
+
 ## Upgrading from v1.x
 
 To upgrade your application using loopback-explorer version 1.x, just replace
@@ -200,11 +208,3 @@ Module Long Term Support (LTS)](http://github.com/CloudNativeJS/ModuleLTS) polic
 | 4.x     | End-of-Life     | Dec 2016  | Apr 2019 |
 
 Learn more about our LTS plan in [docs](https://loopback.io/doc/en/contrib/Long-term-support.html).
-
-## swagger-ui vulnerabilities
-
-There has been a security vulnerability on one of our dependencies `swagger-ui`: https://www.npmjs.com/advisories/985. 
-
-> Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.
-
-LoopBack's API Explorer does not allow clients to import swagger spec from YAML URL/pasted-content. That means loopback-component-explorer **IS NOT AFFECTED** by this vulnerability. For more details, see discussion in https://github.com/strongloop/loopback-component-explorer/issues/263#issuecomment-529385166.