diff --git a/crates/librqbit/src/http_api.rs b/crates/librqbit/src/http_api.rs
index 22e3ba4..8104af3 100644
--- a/crates/librqbit/src/http_api.rs
+++ b/crates/librqbit/src/http_api.rs
@@ -232,6 +232,8 @@ impl HttpApi {
                     "GET /torrents/{index}": "Torrent details",
                     "GET /torrents/{index}/haves": "The bitfield of have pieces",
                     "GET /torrents/{index}/stats": "Torrent stats",
+                    // This is kind of not secure as it just reads any local file that it has access to,
+                    // or any URL, but whatever, ok for our purposes / thread model.
                     "POST /torrents/": "Add a torrent here. magnet: or http:// or a local file."
                 }
             });