diff --git a/README.md b/README.md
index 30ca75b..2690bcf 100644
--- a/README.md
+++ b/README.md
@@ -166,6 +166,17 @@ every machine you ever build. The password is spent, never stored, and never
 reaches `argv` — `curl -K -` reads it from stdin, so it never reaches `ps`
 either.
 
+The clone URL that comes back carries a read-only token inline, and it gets the
+same treatment. The token is split out into
+`~/.config/dotfiles/private-credentials` (mode 600, git-credential-store
+format); `chezmoi init` receives a clean URL, and the helper is written into the
+clone's own config so a later `chezmoi update` still authenticates. Not printing
+it was never sufficient: `/proc/<pid>/cmdline` is world-readable, so passing the
+credential-bearing URL to `chezmoi init` disclosed the token to every account on
+the box for the length of the clone, and then persisted it in `.git/config`
+until the tree was deleted. The redaction that predates this only ever covered
+the trace line.
+
 `dotup --unattended` cannot reach any of this. It has nobody to type a password,
 and it refuses `private` and `invasive` rows outright even if a stale state file
 ticks them.