diff --git a/README.md b/README.md
index 8acb734..1cf462a 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,22 @@ configuration required.
 
 Everything works out of the box. There is nothing to configure to get protected.
 
+## Status
+
+This is a self-distributed release: it is not listed on WordPress.org and has not gone
+through that team's plugin review process.
+
+- **Not independently security audited.** It has been reviewed internally (code review,
+  static checks, a manual security pass over authentication/authorization/nonce/SQL
+  handling), but no third-party security audit or penetration test has been performed.
+- **No CI pipeline yet.** Tests are run manually before each release, not on every commit.
+- **Tested in sandbox/disposable WordPress environments.** Verification so far — install,
+  activation, all admin pages, deactivation, uninstall — was done on disposable WordPress
+  instances, not on live production sites.
+- **Automatic updates are not currently active.** The signed-update mechanism is built in
+  but requires production update infrastructure (a manifest server and signing key) that
+  is not yet deployed. See [Updating](#updating) below for how to update manually.
+
 ## Installation
 
 1. Download the latest release ZIP (see [Releases](#releases) below).