Add note about Java serialization

src/main/java/org/junit/experimental/max/MaxCore.java

diff --git a/src/main/java/org/junit/experimental/max/MaxCore.java b/src/main/java/org/junit/experimental/max/MaxCore.java
index 625cade..0703bdf 100644
--- a/src/main/java/org/junit/experimental/max/MaxCore.java
+++ b/src/main/java/org/junit/experimental/max/MaxCore.java
@@ -44,6 +44,11 @@
 
     /**
      * Create a new MaxCore from a serialized file stored at storedResults
+     * <p>
+     * <strong>WARNING</strong>: If the supplied file exists, it is read using
+     * <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/serialization/">Java Object Serialization</a>.
+     * Deserialization of untrusted data is inherently dangerous and should be
+     * avoided. Care should be taken to ensure the supplied file is trusted.
      */
     public static MaxCore storedLocally(File storedResults) {
         return new MaxCore(storedResults);
@@ -178,4 +183,4 @@
             }
         }
     }
-}
\ No newline at end of file
+}

src/main/java/org/junit/experimental/max/MaxHistory.java

diff --git a/src/main/java/org/junit/experimental/max/MaxHistory.java b/src/main/java/org/junit/experimental/max/MaxHistory.java
index ab7443f..f6378d0 100644
--- a/src/main/java/org/junit/experimental/max/MaxHistory.java
+++ b/src/main/java/org/junit/experimental/max/MaxHistory.java
@@ -29,6 +29,11 @@
     /**
      * Loads a {@link MaxHistory} from {@code file}, or generates a new one that
      * will be saved to {@code file}.
+     * <p>
+     * <strong>WARNING</strong>: If the supplied file exists, it is read using
+     * <a href="https://docs.oracle.com/javase/8/docs/technotes/guides/serialization/">Java Object Serialization</a>.
+     * Deserialization of untrusted data is inherently dangerous and should be
+     * avoided. Care should be taken to ensure the supplied file is trusted.
      */
     public static MaxHistory forFolder(File file) {
         if (file.exists()) {