diff --git a/README.md b/README.md
index 4b536ff..59f4095 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,6 @@
+> [!WARNING]
+> **Use at your own risk.** DataLoom is provided “as is” and “as available,” without warranties of any kind. The author and contributors are not responsible for data loss, corrupted exports, credential exposure, security incidents, incorrect duplicate detection, incorrect merge decisions, or any other direct or indirect damage resulting from the use or misuse of this software. Always work from backups and verify every generated export before using it.
+
 # DataLoom
 
 Offline desktop application for reviewing and merging Bitwarden exports.
@@ -20,6 +23,23 @@ Initial project scaffold and design documentation. Implementation has not starte
 
 Bitwarden exports and the requested full audit log contain secrets. DataLoom must display a prominent warning before import and clearly identify all generated files and their locations. Real exports must never be committed to source control.
 
+## Disclaimer
+
+DataLoom is an independent, unofficial tool and is not affiliated with, endorsed by, or supported by Bitwarden.
+
+The software may process extremely sensitive information, including passwords, authentication secrets, secure notes, payment-card data, and identity information. It is provided without guarantees of correctness, completeness, security, availability, or fitness for any particular purpose.
+
+You are solely responsible for:
+
+- Maintaining safe backups of your original exports
+- Verifying all duplicate classifications and merge results
+- Protecting imported files, output files, and audit logs
+- Confirming that generated exports are complete and valid
+- Assessing whether the software is suitable for your environment
+- Any consequences of using the software
+
+The author and contributors accept no responsibility or liability for loss, disclosure, corruption, compromise, or misuse of data.
+
 ## Planned technology
 
 Python and PySide6/Qt for a desktop application. The initial implementation will use synthetic fixtures only.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..805c58f
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security
+
+DataLoom is designed to process Bitwarden exports locally and offline.
+
+Bitwarden exports may contain passwords, TOTP secrets, secure notes, credit-card data, identities, custom fields, and other highly sensitive information.
+
+## Important rules
+
+- Never upload real Bitwarden exports to public repositories, issue trackers, chat systems, or third-party services.
+- Never commit real exports, merged vault files, audit logs, screenshots, crash dumps, or backups to this repository.
+- Use copies of exports for testing.
+- Review generated output and audit-log locations carefully.
+- Treat full-secret audit logs as equivalent to unencrypted password-vault files.
+- Delete or securely protect generated files when they are no longer required.
+- Use the synthetic fixtures in `tests/fixtures/` for development and testing.
+
+DataLoom does not encrypt imported files, exported files, or audit logs. Users are responsible for protecting all sensitive files created or processed by the application.
+
+## Reporting a security issue
+
+Please do not include real vault exports, passwords, tokens, or other secrets in a bug report. Describe the issue using synthetic data whenever possible. For sensitive reports, contact the repository maintainer privately rather than opening a public issue.
+
+## Scope
+
+This document describes safe handling of data processed by DataLoom. It is not a guarantee that the software is secure or suitable for production use. Review the disclaimer in `README.md` before using the application.