diff --git a/README.md b/README.md
index 7ea8793..d08147c 100644
--- a/README.md
+++ b/README.md
@@ -35,23 +35,29 @@ described [here](https://boto3.readthedocs.io/en/latest/guide/configuration.html
 Regular cleanup job
 -------------------
 
-There is additionally a `s3_media_upload.py` which can be used in a regular job to
-upload content to s3, then delete that from local disk. This script can be used in
-combination with configuration for the storage provider to pull media from s3, but
-upload it asynchronously.
+There is additionally a `s3_media_upload.py` which can be used in a regular job
+to upload content to s3, then delete that from local disk. This script can be
+used in combination with configuration for the storage provider to pull media
+from s3, but upload it asynchronously.
 
-Once the package is installed, the script should be run somewhat like the 
-following. We suggest using tmux or screen as these can take a long time on larger
-servers.
+Once the package is installed, the script should be run somewhat like the
+following. We suggest using tmux or screen as these can take a long time on
+larger servers.
+
+`database.yml` should contain the keys that would be passed to psycopg2 to
+connect to your database. They can be found in the contents of the
+`database`.`args` parameter in your homeserver.yaml.
 
 More options are available in the command help.
 
 ```
 > cd s3_media_upload
-# cache.db will be created if absent. database.yaml is required to contain PG credentials
+# cache.db will be created if absent. database.yaml is required to
+# contain PG credentials
 > ls
 cache.db database.yaml
-# Update cache from /path/to/media/store looking for files not used within 2 months
+# Update cache from /path/to/media/store looking for files not used
+# within 2 months
 > s3_media_upload update /path/to/media/store 2m
 Syncing files that haven't been accessed since: 2018-10-18 11:06:21.520602
 Synced 0 new rows
diff --git a/scripts/s3_media_upload b/scripts/s3_media_upload
index b8e08d8..672c175 100644
--- a/scripts/s3_media_upload
+++ b/scripts/s3_media_upload
@@ -311,7 +311,7 @@ def get_postgres_conn(parser):
     """Attempt to get a postgres connection based on database.yaml, or exit.
     """
     try:
-        database_yaml = yaml.load(open("database.yaml"))
+        database_yaml = yaml.safe_load(open("database.yaml"))
     except FileNotFoundError:
         parser.error("Could not find database.yaml")
     except yaml.YAMLError as e: