diff --git a/README.md b/README.md
index 387d208..366a5ea 100644
--- a/README.md
+++ b/README.md
@@ -24,3 +24,9 @@ Secrets are managed via HashiCorp Vault at `https://vault.nexus.local`.
 - bash >= 5.0
 - curl, rsync, awscli v2
 - Vault CLI (for secret retrieval)
+
+## Secret management
+
+Use the company Vault at `https://vault.nexus.local` for all secrets.
+**Never commit credentials to version control.**
+See `lib/vault.sh` for runtime secret retrieval.