diff --git a/documentation/contribute/TUTORIAL.md b/documentation/contribute/TUTORIAL.md
index daefcd1cb..bc8374949 100644
--- a/documentation/contribute/TUTORIAL.md
+++ b/documentation/contribute/TUTORIAL.md
@@ -38,6 +38,8 @@ If the push step fails with a permission error, check **Settings → Actions →
 
 **Pull requests → New pull request**, base: your main branch, compare: `contributor`. Review it like any outside contribution, and merge when you're happy. If the pull request stays open, it updates itself each time the Action brings new commits.
 
+**Keep your secrets out of its CI.** A pull request from a branch in your own repo (unlike one from a fork) runs your `pull_request` workflows **with your repository secrets**, and those runs execute the contributor's code. The guard stops changes to your workflows, not code running inside them. So for `contributor` pull requests, run checks that need no secrets, and keep secret-using steps in `push` or `workflow_dispatch` jobs, or behind a protected environment with required reviewers.
+
 ## Good to know
 
 - **Turn it off:** delete the file, or use **Actions → Pull contributor → ⋯ → Disable workflow**.