diff --git a/documentation/configuration/web_storage.md b/documentation/configuration/web_storage.md
index 9b0b9036621e10efc3d5b4337b0dce36399473b8..eb4cef6c3fa4bd95c3e2b664ba4439643fb6d38f 100644
--- a/documentation/configuration/web_storage.md
+++ b/documentation/configuration/web_storage.md
@@ -11,3 +11,8 @@ and the link to that file, based on `service.web_url`, is sent to the user.
 That means that you should configure the web-server on the machine where you run Spectrum 2 to serve `service.web_directory`.
 
 If you for example use httpd, you can configure `service.web_directory=/var/www/html/spectrum2`. In that case, the matching `service.web_url` value will be `service.web_url=http://domain.tld/spectrum2`.
+
+### Security
+
+You should not configure the webserver to allow listing files in the `service.web_directory`.
+