diff --git a/README.md b/README.md
index 5f1ccc7..f953954 100644
--- a/README.md
+++ b/README.md
@@ -136,4 +136,9 @@ The script ensures .NET 10 and Ollama are installed, builds the client self-cont
 ## Notes
 
 - Request and response bodies are streamed through the tunnel, which is important for Ollama streaming responses.
-- Use HTTPS or a private network/VPN when exposing this outside a trusted network. The token is simple shared-secret protection, not a full access-control system.
+
+## Security notes
+
+- Use HTTPS or a private network/VPN when exposing this outside a trusted network.
+- **Tokens in URLs** (`/token/<token>/...` and `?token=...`) are logged by web servers (Apache, Nginx, Kestrel), reverse proxies, and browsers (history). Malicious MITM proxies can also read them. Prefer header-based auth (`X-Reverse-Llama-Token` or `Authorization: Bearer`) when your client supports it.
+- The token is simple shared-secret protection, not a full access-control system.
diff --git a/src/ReverseLlama.Server/TokenAuthentication.cs b/src/ReverseLlama.Server/TokenAuthentication.cs
index 2e8c502..f05e527 100644
--- a/src/ReverseLlama.Server/TokenAuthentication.cs
+++ b/src/ReverseLlama.Server/TokenAuthentication.cs
@@ -47,6 +47,9 @@ internal static class TokenAuthentication
             }
         }
 
+        // Path-token auth: useful for clients that cannot send headers.
+        // SECURITY: the token appears in the URL and will be logged by
+        // web servers, proxies, and browsers. Prefer header auth when possible.
         if (allowPathToken
             && TryGetPathToken(request.Path, out var pathToken, out _))
         {
@@ -57,6 +60,9 @@ internal static class TokenAuthentication
             }
         }
 
+        // Query-string auth: needed for clients that cannot send headers
+        // (e.g. browser address bar, status page).
+        // SECURITY: same URL-logging risks as path-token auth above.
         if (allowQueryToken
             && request.Query.TryGetValue("token", out var queryValues))
         {