diff --git a/examples/external-demo/README.md b/examples/external-demo/README.md
index 0064957..34b5c5d 100644
--- a/examples/external-demo/README.md
+++ b/examples/external-demo/README.md
@@ -11,8 +11,9 @@ different origin than Ham Lab. It knows a base URL and a read-only sensor token
 window.HAMLAB = { base: 'http://10.0.0.234:8100', token: '<read-only sensor token>' }
 ```
 
-Anyone who can load the page can read the token, so serve it only where that's acceptable
-(it can read sensors and nothing else). Deployed on `core` as the `hamlab-demo` stack —
+Anyone who can load the page can read the token. If the page is public, limit the token to
+patterns that name nothing you'd mind the world reading (the `hamlab-demo` one shows
+hardware numbers and counts, not container or service names). Deployed on `core` as the `hamlab-demo` stack —
 see Hamlet `docs/docker.md`. Update it with
 `cp examples/external-demo/index.html /home/core/apps/hamlab-demo/site/`.