Clarify README encoded delimiter safety guidance

Co-authored-by: Shri Sukhani <shrisukhani@users.noreply.github.com>

Author: cursoragent

README.md

@@ -31,7 +31,7 @@ export HYPERBROWSER_HEADERS='{"X-Correlation-Id":"req-123"}' # optional JSON obj
 and not contain query parameters, URL fragments, backslashes, control characters,
 or whitespace/newline characters.
 `base_url` must not include embedded user credentials.
-Unsafe encoded host/path forms (for example encoded traversal segments) are also rejected.
+Unsafe encoded host/path forms (for example encoded traversal segments or encoded host/path delimiters) are also rejected.
 The SDK normalizes trailing slashes automatically.
 If `base_url` already ends with `/api`, the SDK avoids adding a duplicate `/api` prefix.
 If `HYPERBROWSER_BASE_URL` is set, it must be non-empty.