diff --git a/docs/admin/configuration.md b/docs/admin/configuration.md
index ebe44cc1..11185bab 100644
--- a/docs/admin/configuration.md
+++ b/docs/admin/configuration.md
@@ -50,6 +50,22 @@ RUSTCHAT_REDIS_URL=redis://localhost:6379/
 | `RUSTCHAT_S3_REGION` | No | `us-east-1` | S3 region |
 | `RUSTCHAT_S3_PUBLIC_URL` | No | - | Public URL for file access |
 
+> **Private bucket by design**
+>
+> RustChat stores uploaded files in a **private** S3/RustFS bucket by default. Uploaded objects are not
+> accessible via unsigned direct object-store URLs — attempting to fetch them without a valid signature or
+> presigned URL should return a `403 Forbidden` response. This is intentional: access to files is mediated
+> by RustChat, either through authenticated RustChat endpoints or through time-limited presigned URLs that
+> RustChat generates after authorising the requester. This design keeps files scoped to their workspace and
+> prevents unauthorised access.
+>
+> **Do not change the bucket to public.** Making the bucket public removes this protection and exposes all
+> uploaded files — including attachments in private channels — to anyone who knows or guesses an object URL.
+>
+> If you need to serve files via a CDN or reverse-proxy, configure it to work with authenticated RustChat
+> endpoints or RustChat-generated presigned URLs rather than bypassing RustChat by pointing directly at the
+> object store.
+
 ### CORS
 
 | Variable | Required | Default | Description |