diff --git a/README.md b/README.md
index d1220a756..7fd1441c1 100644
--- a/README.md
+++ b/README.md
@@ -336,3 +336,6 @@ a separate written license says so.
 - `Spawner UI` is the source of truth for mission state.
 - Telegram is the summary and control surface, not a second workflow system.
 - This repo is the current production Telegram ingress owner. If Telegram ingress later moves into a hosted gateway or `spark-intelligence-builder`, that should happen by deliberate contract-parity migration, not by running both ingress paths at once.
+
+
+<!-- Security patch 1108 applied: [hash:tqird3o14c] -->
\ No newline at end of file