diff --git a/SECURITY.md b/SECURITY.md
index 92b5c22..a24d4f1 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -53,6 +53,7 @@ Send an email to **opensource@openagenthq.com** with:
 - Never commit secrets or `.env` files (see `.gitignore`).
 - Raise typed `ModelDockError` subclasses — never swallow errors silently.
 - Run `bandit -r src` as part of local checks.
+- Treat output from adapters, particularly from the cli/core/adapters/docs module, as untrusted; never execute or evaluate it directly.
 
 ## Contact