diff --git a/README.md b/README.md
index e64bb88..4672db6 100644
--- a/README.md
+++ b/README.md
@@ -257,8 +257,10 @@ structures, never gives an agent more reach than its sandbox. What that means to
   gets only a narrowly scoped skills token, never a ClawMates session. **Model-provider keys are the
   exception:** Claude Code inside a mission needs its own credential, so container-tier missions carry
   the provider keys (`CLAUDE_CODE_OAUTH_TOKEN`, and `ZAI_API_KEY` / `KIMI_API_KEY` for the fallback
-  chain) in their environment, readable by the agent. The server reaches Docker through an allow-listed
-  socket proxy.
+  chain) in their environment, readable by the agent. What limits the damage: delivery refuses to push
+  any change containing one of those keys (exact values, verbatim or base64), and every recorded event,
+  judge verdict and judge input is redacted before it is stored or sent. A key sent straight to a host
+  over the network is not covered yet. The server reaches Docker through an allow-listed socket proxy.
 - The gate is a guardrail against accidents and obvious exfiltration, not a boundary against a
   determined agent (indirection defeats string matching). The boundaries are the VM, the network policy
   and the broker.