diff --git a/AGENTS.md b/AGENTS.md
index a9dbe8e..2d0263b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -156,6 +156,13 @@ See `serverAppConfigs-docs/Architecture/Testing Policy.md`.
   credentials).
 - Do not document passwords anywhere in the repo. SSH keys are the auth
   mechanism; `FRANK_SUDO_PW` covers headless sudo and never enters the repo.
+- **A token passed as `curl -H "Authorization: Bearer …"` is world-readable.**
+  It lands in `/proc/<pid>/cmdline`, so any `ps`/`pgrep -a` on the host prints
+  it — that leaked an HF token into a session transcript on 2026-09-16, while
+  merely checking whether a download was still running. Pass secrets out of
+  band (`curl -K <mode-600 file>` carrying the header, or `HF_TOKEN` in the
+  environment for `hf`/`hf_transfer`) and never `pgrep -a` a fetch command that
+  carries an auth header.
 
 ## External Exposure Policy (MANDATORY)