1 files changed, 6 insertions, 1 deletions
diff --git a/README.md b/README.md
index 9043f4b..b27e50f 100644
--- a/README.md
+++ b/README.md
@@ -43,7 +43,12 @@ docker-compose up --build
 
 ## Environment variables
 
-Copy `.env.example` to `.env` and fill in the values:
+Copy `.env.example` to `.env` and fill in the values. Since it contains secrets (database passwords, app secret), restrict read access to your user only:
+
+```sh
+cp .env.example .env
+chmod 600 .env   # owner-only read/write — prevents other users on the host from reading secrets
+```
 
 | Variable | Purpose |
 |----------|---------|