diff --git a/README.md b/README.md
index a60638c..abb40a1 100644
--- a/README.md
+++ b/README.md
@@ -125,7 +125,9 @@ curl -X POST https://auth.example.com/admin/apps \
 ```rust
 use atauth::TokenVerifier;
 
-let verifier = TokenVerifier::new(b"your-hmac-secret");
+// Secret must be at least 32 bytes (256 bits) for security
+let verifier = TokenVerifier::new(b"your-hmac-secret-at-least-32-bytes!")
+    .expect("Secret must be at least 32 bytes");
 
 match verifier.verify(token) {
     Ok(payload) => {
diff --git a/SECURITY.md b/SECURITY.md
index 2b9fcfb..6cde68c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -17,7 +17,9 @@ Instead, please send an email describing the vulnerability to the maintainers. I
 
 | Version | Supported          |
 | ------- | ------------------ |
-| 0.1.x   | Yes                |
+| 1.2.x   | Yes                |
+| 1.0.x   | Security fixes only |
+| < 1.0   | No                 |
 
 ## Security Best Practices