diff --git a/README.md b/README.md
index ba2fc7b..60bbc54 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,8 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 
 ## Main features
 
+- **Read-only**: lazysecrets never creates, changes or deletes a secret, so
+  it's safe to point at production. That's by design and may stay that way.
 - **Zero setup**: uses the logins you already have (`az`, the Databricks
   CLI, `sops`, `git`). No config file needed.
 - **Search everything**: `ctrl+s` searches every source at once, with
@@ -25,7 +27,7 @@ A terminal UI for finding, reading and sharing secrets. Inspired by the fantasti
 - **Try it first**: `lazysecrets --demo` runs on built-in sample data.
 - **Supported platforms**: Azure Key Vault, Databricks secret scopes, and SOPS and `.env` files in your git repos. 
 
-> Early development: expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
+> **Early development:** expect rough edges. See [CHANGELOG.md](CHANGELOG.md) for what's new.
 
 ## Install