diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 000000000..3ac402054
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1 @@
+See [changelog for @google/generative-ai](/packages/main/CHANGELOG.md)
\ No newline at end of file
diff --git a/README.md b/README.md
index 54f7d46ef..13e71b2d1 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,12 @@
-# Google AI JavaScript SDK
+# Google AI SDK for JavaScript
+
+> [!CAUTION]
+> **Using the Google AI SDK for JavaScript directly from a client-side app is
+> recommended for prototyping only.** If you plan to enable billing, we strongly
+> recommend that you call the Google AI Gemini API only server-side to keep your
+> API key safe. You risk potentially exposing your API key to malicious actors
+> if you embed your API key directly in your JavaScript app or fetch it remotely
+> at runtime.
 
 The Google AI JavaScript SDK enables developers to use Google's state-of-the-art generative AI models (like Gemini) to build AI-powered features and applications. This SDK supports use cases like:
 - Generate text from text-only input
diff --git a/packages/main/README.md b/packages/main/README.md
index 3e965a5a0..34cc88d3e 100644
--- a/packages/main/README.md
+++ b/packages/main/README.md
@@ -1,4 +1,12 @@
-# Google AI JavaScript SDK
+# Google AI SDK for JavaScript
+
+> [!CAUTION]
+> **Using the Google AI SDK for JavaScript directly from a client-side app is
+> recommended for prototyping only.** If you plan to enable billing, we strongly
+> recommend that you call the Google AI Gemini API only server-side to keep your
+> API key safe. You risk potentially exposing your API key to malicious actors
+> if you embed your API key directly in your JavaScript app or fetch it remotely
+> at runtime.
 
 The Google AI JavaScript SDK enables developers to use Google's state-of-the-art generative AI models (like Gemini) to build AI-powered features and applications. This SDK supports use cases like:
 - Generate text from text-only input