diff --git a/app/Http/Middleware/PublicSiteGate.php b/app/Http/Middleware/PublicSiteGate.php
index e9637bf..23f38ca 100644
--- a/app/Http/Middleware/PublicSiteGate.php
+++ b/app/Http/Middleware/PublicSiteGate.php
@@ -31,6 +31,14 @@ class PublicSiteGate
      * able to drive portal components — including billing — while the portal is
      * supposed to be offline. Operators pass the check below anyway, which is
      * what the console actually needs.
+     *
+     * Nor is /login, and that has a consequence worth knowing before you hide
+     * the site: /admin sends a guest to /login, which is not the console, so
+     * SIGNING IN while hidden needs the request to come from a trusted range —
+     * the management VPN, or an address put in TRUSTED_RANGES for the initial
+     * setup. Exempting the login flow by hostname instead would mean trusting a
+     * Host header, which the caller chooses, and one forged header would unhide
+     * the entire portal.
      */
     private const ALWAYS_ALLOWED = ['admin', 'admin/*', 'webhooks/*', 'up', 'robots.txt'];