diff --git a/SECURITY.md b/SECURITY.md
index be3280c..464499b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -19,3 +19,12 @@ These capabilities are necessary for Tailscale to function but increase the atta
 - Regularly rotate auth keys.
 - Review Headscale/Tailscale ACLs to ensure services only have the access they need.
 - Keep the Tailscale Docker image reasonably up to date.
+
+## Default Passwords
+
+The `docker-compose.yml` file contains placeholder values (`***`) for sensitive items such as:
+
+- Postgres password
+- Vikunja JWT secret
+
+**Change these values** before deploying anywhere security matters. Never use the default placeholders in production or shared environments.