Index: README.md
===================================================================
--- README.md	(revision 09ee2bd19e715e798f3d2b165d1d90f9c37eba7d)
+++ README.md	(revision 69815b232bc91b7504ea8b28d3e2f66949f216ed)
@@ -115,4 +115,10 @@
 ```
 
+By default the app binds to `127.0.0.1` (via `HOST` in `.env`), so only your
+reverse proxy can reach it — not the open internet. Local testing on the same
+machine (`localhost:3000`) still works. Only set `HOST=0.0.0.0` if you need direct
+external access without a proxy (then open the port in your firewall and add HTTPS
+yourself).
+
 (`cwebp` is optional — `apt install webp` — for WebP image conversion.)