diff --git a/README.md b/README.md
index 79ad59d..563334d 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,12 @@ A modern self-hosted media library system built with Go, PostgreSQL, HTMX, and T
 - **Multi-User Support**: Complete user registration and authentication system
 - **JWT-Based Sessions**: Secure token-based authentication with localStorage persistence
 - **Role-Based Access**: Admin and user roles with granular permission control
-- **Password Security**: bcrypt hashing with secure password requirements
+- **Password Security**: bcrypt hashing with secure password requirements (min 6 characters)
+- **Rate Limiting**: Built-in rate limiting on auth endpoints (10 requests/minute) to prevent brute force attacks
+- **Input Validation**: Comprehensive validation including username whitespace checks, email format validation
+- **Pagination Protection**: Maximum pagination limits (1000 items) to prevent DoS attacks
+- **Path Validation**: Library folder paths are validated for existence and accessibility
+- **Case-Insensitive Roles**: Role values automatically normalized to lowercase
 
 ### 🎨 Beautiful UI
 - **11 Dark Themes**: Tokyo Night, Dracula, Nord, Solarized Dark, Monokai, One Dark Pro, Material Dark, Catppuccin variants