diff --git a/.env.example b/.env.example
index 747d4e2..a9aebd8 100644
--- a/.env.example
+++ b/.env.example
@@ -1,3 +1,7 @@
+# === Runtime ===
+# Set to true ONLY in local dev. Werkzeug debugger = RCE if exposed.
+CM_DEBUG=false
+
 # === Deployment Identity ===
 # Unique name prefix for containers and network (avoid conflicts on same host)
 CM_DEPLOY_NAME=rex-cm