Add security section.

README.md

@@ -61,6 +61,16 @@ JWT_SECRET=dev-secret-change-me-do-not-use-in-production mvn spring-boot:run
 - The service returns structured error responses for application-level failures so clients can handle validation, authentication, authorization, and conflict cases predictably.
 - This implementation favors clarity over extra infrastructure. Features such as refresh tokens, token revocation, audit logging, pagination, rate limiting, and OpenAPI generation would be good production follow-ups.
 
+## Security considerations
+
+- Passwords are hashed with BCrypt before being persisted. Plaintext passwords are accepted only in registration/login request bodies and are never returned by the API.
+- Authentication uses JWT bearer tokens. Protected endpoints require an `Authorization: Bearer <token>` header.
+- The JWT signing secret is supplied through configuration. The local development value should not be used in production; production deployments should load it from an environment variable or secret manager.
+- Access control is enforced in the service layer. Users can read and modify only their own notes unless a note has been explicitly shared with them.
+- Shared notes are read-only for recipients. Only the owner can update, delete, or share a note.
+- The API returns `404 Not Found` for another user's unshared note so callers cannot distinguish between a missing note and a note they are not allowed to see.
+- Production deployments should run behind HTTPS, avoid logging credentials or tokens, and consider token expiration, rotation, revocation, rate limiting, and audit logging.
+
 ## Testing
 
 The automated tests run with Spring Boot, MockMvc, Spring Security, JPA, validation, and Flyway-backed H2 enabled. This keeps the tests close to real API behavior while still making them fast enough to run locally.