diff --git a/README.md b/README.md
index c33b3aa..d37f45d 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,37 @@
 # InstaArchive Viewer
 
+> [!CAUTION]
+> ## This branch must not be published to GitHub
+>
+> You are on **`tooling`**. It is the only branch that still contains the
+> archive-fetching scripts and their docs, and those name things `main` was
+> rewritten to remove:
+>
+> - the fetch host's **public IP** (`docs/gallery-dl.md`)
+> - the browser profile the session cookie is read from
+> - the NAS archive path
+> - the **list of Instagram accounts being archived**
+>
+> On 2026-08-20 `main`'s entire history was rewritten with `git filter-repo`,
+> the GitHub repo was deleted and recreated, and 22 container images were
+> pruned from ghcr — all to remove exactly this material from public view.
+> **One push of this branch to GitHub undoes all of it**, and the second
+> cleanup would be harder than the first: force-push residue stayed reachable
+> by SHA until the repo itself was deleted.
+>
+> Guards in place, neither of them foolproof:
+>
+> - `.git/hooks/pre-push` rejects any ref but `main`/tags to the GitHub remote.
+>   It is **local and unversioned** — a fresh clone does not have it.
+> - `git config remote.github.push refs/heads/main:refs/heads/main`.
+>
+> Recreate both after cloning. `origin` is gitea and is the right default for
+> everything; GitHub only ever needs `main` and the current release tag.
+>
+> *This block exists only on `tooling`. If a merge from `main` ever conflicts
+> here, keep both sides — the warning is not something `main` deleted.*
+
+
 A high-performance React PWA for browsing archived Instagram data with a native-feeling interface. Supports both official Instagram exports and Instaloader archives.
 
 ## Features