From 712b18ff89d955397df84dcae0399f1c95c8ad12 Mon Sep 17 00:00:00 2001
From: lichenblankie <lichenblankie@derickphan.com>
Date: Fri, 5 Jun 2026 02:18:54 +0000
Subject: [PATCH] add forum security caveat link to Security section

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index e6b4552..71015c0 100644
--- a/README.md
+++ b/README.md
@@ -229,6 +229,7 @@ Other hardening measures:
 - **XSS escaping** — All user-supplied content is HTML-escaped before rendering
 - **Bookmark authentication** — The bookmarklet endpoint requires a secret token
 - **Identity file protection** — The Reticulum identity key is restricted to owner-only permissions (0600)
+- **Forum caveats** — See [tinyweb-forum Security](https://git.derickphan.com/lichenblankie/tinyweb-forum#security) for forum-specific risks (voluntary retractions, block gossip manipulation, no rate limiting)
 
 ## Maintenance