diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 7702738..d57c52e 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -41,6 +41,35 @@ jobs:
           docker push ${IMAGE}:latest
           docker push ${IMAGE}:${{ github.sha }}
 
+      # ---------------------------------------------------------------------
+      # ⚠️ SECURITY REVIEW NOTES (see pc_builder remediation plan, item 1.4)
+      # ---------------------------------------------------------------------
+      # This deploy step has two known issues that were flagged during a
+      # security review but intentionally NOT auto-fixed here (no access to
+      # reconfigure the NAS SSH/sudo setup from this environment):
+      #
+      # 1. `.env.production` was removed from git tracking (it contained
+      #    plaintext APP_KEY/DB_PASSWORD and should never have been
+      #    committed). The `cat .env.production` line below now reads a
+      #    file that will NOT exist in a fresh `git clone` of this repo,
+      #    since this job clones the repo from scratch at the top of the
+      #    `docker` job. This step WILL fail until the deployment secrets
+      #    are migrated to Gitea Actions secrets and the `.env` file is
+      #    generated at deploy time instead of committed, e.g.:
+      #      printf 'APP_KEY=%s\nDB_PASSWORD=%s\n...' \
+      #        "${{ secrets.APP_KEY }}" "${{ secrets.DB_PASSWORD }}" | \
+      #        sshpass ... "cat > /volume1/docker/pc_builder/.env"
+      #    Until that migration happens, whoever runs this pipeline must
+      #    place a non-committed `.env.production` file back in the
+      #    repository checkout (or update this script) for deploys to work.
+      #
+      # 2. The NAS password (`secrets.NASPASS`) is passed on the command
+      #    line via `sshpass -p` and `sudo -S`, which can leak through
+      #    process listings and CI logs. Recommended remediation: switch to
+      #    a dedicated SSH key stored as a Gitea secret, and configure a
+      #    scoped passwordless `sudo` (NOPASSWD) on the NAS limited to the
+      #    exact commands below (setup-db.sh, docker compose, docker exec),
+      #    rather than transiting the interactive user's password.
       - name: Deploy on NAS
         run: |
           apk add --no-cache openssh-client sshpass