diff --git a/README.md b/README.md
index 687f360..cd58e4b 100644
--- a/README.md
+++ b/README.md
@@ -96,3 +96,5 @@ curl -H "Authorization: token $GITEA_TOKEN"   -F "attachment=@tailrescue-headsca
 ```
 
 Do not commit ISO files into Git.
+
+Note: the repository is public so Release attachments can be downloaded without authentication. Do not commit secrets or field-specific `rescue.env`; rotate preauth keys per build.
diff --git a/docs/runbook.md b/docs/runbook.md
index d75a487..b40da57 100644
--- a/docs/runbook.md
+++ b/docs/runbook.md
@@ -62,3 +62,5 @@ curl -H "Authorization: token $GITEA_TOKEN"   -F "attachment=@tailrescue-headsca
 ```
 
 Do not commit ISO files into Git.
+
+Note: the repository is public so Release attachments can be downloaded without authentication. Do not commit secrets or field-specific `rescue.env`; rotate preauth keys per build.