diff --git a/SECURITY.md b/SECURITY.md
index 957b3df..22832e7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -10,7 +10,7 @@ Report security concerns privately to the maintainer. Do not open public issues
 
 ## Secrets And Data
 
-- Do not commit  files, API keys, Wi-Fi credentials, session cookies, private keys, dumps, captures, or personal data.
+- Do not commit `.env` files, API keys, Wi-Fi credentials, session cookies, private keys, dumps, captures, or personal data.
 - Firmware binaries and captured artifacts must include provenance notes and SHA256 hashes before release.
 - Generated dependency folders and build output belong outside Git unless there is a documented reason.