diff --git a/README.md b/README.md
index e6b4552..71015c0 100644
--- a/README.md
+++ b/README.md
@@ -229,6 +229,7 @@ Other hardening measures:
 - **XSS escaping** — All user-supplied content is HTML-escaped before rendering
 - **Bookmark authentication** — The bookmarklet endpoint requires a secret token
 - **Identity file protection** — The Reticulum identity key is restricted to owner-only permissions (0600)
+- **Forum caveats** — See [tinyweb-forum Security](https://git.derickphan.com/lichenblankie/tinyweb-forum#security) for forum-specific risks (voluntary retractions, block gossip manipulation, no rate limiting)
 
 ## Maintenance