diff --git a/secrets/README.md b/secrets/README.md
new file mode 100644
index 0000000..d7df366
--- /dev/null
+++ b/secrets/README.md
@@ -0,0 +1,5 @@
+# secrets
+
+Nothing secret lives in this repo. Work credentials go in a `.env` next to
+`bootstrap.sh`, and that path is gitignored. I keep the real values in `pass`
+(the standard unix password store), not here.