diff --git a/README.md b/README.md
index 639ed8c..fd05c39 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,10 @@ This document provides you with an idea and a solution for restricting web acces
 
 If you want to access a file on your webserver, but you also don't want it to be publicly accessible, then you maybe found out about http basic auth, but then you noticed that it's not so convenient to use with mpv and this is exactly where this solution comes and saves your day and future.
 
+# Attention
+
+The key is not private, it will be sent to the http server and will be written in plaintext to the access log if an access log is being written, take this into account. For best security practice only use this solution with your own http server where you are in control.
+
 `mpv` has a config option that lets you specify a custom useragent: https://github.com/mpv-player/mpv/blob/master/etc/mpv.conf#L99
 
 Specify your personal auth token in your mpv.conf then;