diff --git a/README.md b/README.md
index 711a554..4da16fa 100644
--- a/README.md
+++ b/README.md
@@ -212,6 +212,22 @@ goes back to listening. Without `--serve` the same failure exits with an error.
 udpcp recv 9000 --serve          # loop indefinitely
 ```
 
+## Security model
+
+udpcp has no authentication or encryption. Any host that can reach the
+receiver's UDP port can deliver a file: the filename is sanitized (path
+components and control characters are rejected), but the content and its
+SHA-256 are supplied by the sender — the integrity check protects against
+transport corruption, not against a malicious peer. A sender can create or
+overwrite `<name>` and `<name>.tmp` in the receiver's working directory (or
+the explicit output path).
+
+Run the receiver only on trusted networks or inside an encrypted tunnel such
+as WireGuard.
+
+> **Planned**: pre-shared-key INIT authentication (HMAC-SHA256 over the INIT
+> payload) so a receiver only accepts transfers from peers holding the key.
+
 ## MTU tuning
 
 Link MTU varies by path. Standard Ethernet is 1500 B; some paths are as low
diff --git a/src/cli.rs b/src/cli.rs
index 54672f7..ea5f0c4 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -55,7 +55,7 @@ struct SendArgs {
     #[arg(long, value_name = "KIB/S", default_value_t = 512)]
     bw: u64,
 
-    /// Chunk size (1–65500)
+    /// Chunk size (1–65500; max 65468 with --verify)
     #[arg(long, value_name = "BYTES", default_value_t = DEFAULT_CHUNK_SIZE)]
     chunk: u32,