diff --git a/docs/security.md b/docs/security.md
index dd5c999b..350fa7e9 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -84,7 +84,7 @@ into an agent's config, that agent has exactly that reach, with no hyperhive
 layer narrowing it. Scope external tokens tightly at the source (the external
 provider) before handing them over.
 
-
+## State-file endpoint security model
 
 `GET /api/state-file?path=<p>` serves files from agent state dirs and
 the shared space to authenticated dashboard users (browser, operator).