diff --git a/src/components/WalletModal.tsx b/src/components/WalletModal.tsx
index 38f6a8e..a971ee9 100644
--- a/src/components/WalletModal.tsx
+++ b/src/components/WalletModal.tsx
@@ -1,5 +1,5 @@
 import { useState, forwardRef } from 'react';
-import { Wallet, Plus, Trash2, Zap, Globe, WalletMinimal, CheckCircle, X } from 'lucide-react';
+import { Wallet, Plus, Trash2, Zap, Globe, WalletMinimal, CheckCircle, X, ShieldAlert } from 'lucide-react';
 import { Button } from '@/components/ui/button';
 import {
   Dialog,
@@ -63,6 +63,21 @@ const AddWalletContent = forwardRef<HTMLDivElement, {
         rows={3}
       />
     </div>
+    {/* Security guidance: an NWC string is a spend credential. Encourage users
+        to cap it in their wallet so a compromised connection can't be drained. */}
+    <div className="flex gap-2.5 rounded-lg border border-amber-500/30 bg-amber-500/10 p-3">
+      <ShieldAlert className="h-4 w-4 flex-shrink-0 text-amber-500 mt-0.5" />
+      <div className="space-y-1 text-xs text-amber-200/90">
+        <p className="font-semibold text-amber-300">Set a spending limit first</p>
+        <p>
+          This string lets SkateSpots pay Lightning invoices from your wallet. In
+          your wallet app, give this connection a small <strong>daily budget</strong>{' '}
+          (e.g. a few thousand sats) and enable only <strong>pay_invoice</strong>.
+          Never paste a connection with an unlimited budget. You can revoke it in
+          your wallet any time.
+        </p>
+      </div>
+    </div>
   </div>
 ));
 AddWalletContent.displayName = 'AddWalletContent';