diff --git a/.env.example b/.env.example
index 0a7cdab..24f08ac 100644
--- a/.env.example
+++ b/.env.example
@@ -1,13 +1,21 @@
 # Web3Forms access key, used by the feedback form at /feedback.
 #
-# Get it from https://web3forms.com — it is the key tied to the destination
-# inbox. It is a publishable key (it must reach the browser to work, and grants
-# no account access), which is why it carries the NEXT_PUBLIC_ prefix. It is
-# still kept out of the repo so this public repository does not ship a
-# ready-made endpoint for anyone to post to.
-#
-# Set the same variable in Vercel: Project -> Settings -> Environment Variables,
-# for Production, Preview and Development.
+# Get it from https://web3forms.com. It is a publishable value rather than a
+# secret: it has to reach the browser to work, it is compiled into the client
+# bundle, and it grants no account access, which is why it carries the
+# NEXT_PUBLIC_ prefix. Web3Forms treats it as the form's own identifier, and
+# its API reports it as "form_id/access_key".
+#
+# It is kept out of the source tree so that cloning this repository does not
+# hand over a working endpoint by default, and so local and deployed
+# environments can differ. Treat that as hygiene, not confidentiality: the
+# value is readable from the deployed site by anyone who views source, and one
+# earlier commit in this repository's history contains a real one.
+#
+# Set the same variable in Vercel: Project -> Settings -> Environment
+# Variables, for Production, Preview and Development. The value is inlined at
+# build time, so changing it does nothing to a deployment that already exists.
+# Redeploy after changing it, or the old value stays live.
 #
 # Without it the form renders and validates, but submitting reports that the
 # form is not configured rather than silently discarding the message.
diff --git a/SECURITY.md b/SECURITY.md
index 968093e..2c79715 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -37,14 +37,18 @@ site.
 
 ## A note on the Web3Forms access key
 
-The feedback form's access key is a publishable value. It is prefixed
-`NEXT_PUBLIC_`, it is compiled into the client bundle by design, and it is
-therefore visible to anyone viewing source. That is how Web3Forms works and is
-not a vulnerability on its own. Submissions are restricted to this site's
-domain in the Web3Forms dashboard.
-
-If you find a way to abuse it despite that restriction, that is very much in
-scope and worth reporting.
+The feedback form's access key is a publishable value rather than a secret. It
+is prefixed `NEXT_PUBLIC_`, it is compiled into the client bundle by design,
+and it is therefore visible to anyone viewing source. Web3Forms treats it as
+the form's own identifier, so its being visible is not a vulnerability and does
+not need reporting.
+
+Submissions are additionally restricted to this site's domain in the Web3Forms
+dashboard. That restriction is worth having, but it is enforced on a request
+header, so it raises the effort required rather than preventing abuse outright.
+
+If you find a way to abuse the form, including past that restriction, that is
+in scope and worth reporting.
 
 ## Reporting an incorrect tax figure