diff --git a/pkg/ssh/ssh.go b/pkg/ssh/ssh.go
index f273a91..4fe2be3 100644
--- a/pkg/ssh/ssh.go
+++ b/pkg/ssh/ssh.go
@@ -67,6 +67,9 @@ func (c *Client) getConfig() *ssh.ClientConfig {
 }
 
 // Run executes a command on the remote host and returns the combined stdout and stderr.
+//
+// command MUST be a hardcoded shell literal or constructed entirely from
+// internal, service-controlled values — never from user-supplied HTTP input.
 func (c *Client) Run(command string) (string, error) {
 	config := c.getConfig()