Updated README

README.md

@@ -192,7 +192,7 @@ Optional but recommended — drop the [`slicer-api/` Compose stack](slicer-api/R
 
 ### 📁 File Manager (Library)
 - Upload and organize sliced files (3MF, gcode, STL)
-- **External folder mounting** - Mount host directories (NAS, USB, network shares) without copying files
+- **External folder mounting** - Mount host directories (NAS, USB, network shares) without copying files. Operator-controlled via the `BAMBUDDY_EXTERNAL_ROOTS` env var (colon-separated allowlist of host paths users are permitted to register; empty by default to disable the feature). See [Docker → External library folders](https://wiki.bambuddy.cool/getting-started/docker/#external-library-folders-bambuddy_external_roots).
 - **STL thumbnail generation** - Auto-generate previews for STL files on upload or batch generate for existing files
 - ZIP file extraction with folder structure preservation
 - Option to create folder from ZIP filename
@@ -704,22 +704,21 @@ Contributions welcome! Ways to help:
 2. **Test** — Report issues with your printer model
 3. **Translate** — Add new languages
 4. **Code** — Submit PRs for bugs or features
+5. **🔒 Security review** — *(specifically wanted, see below)*
 
 Not sure where to start? Reach out on [Discord](https://discord.gg/aFS3ZfScHM) or email **martin@bambuddy.cool** — I'll help you find something that fits.
 
-```bash
-# Development setup
-git clone https://github.com/maziggy/bambuddy.git
-cd bambuddy
+### 🔒 Looking for a security-focused contributor
 
-# Backend
-python3 -m venv venv && source venv/bin/activate
-pip install -r requirements.txt
-DEBUG=true uvicorn backend.app.main:app --reload
+I'm bringing on a contributor whose specific focus is keeping an eye on Bambuddy's security.
 
-# Frontend (separate terminal)
-cd frontend && npm install && npm run dev
-```
+Concretely:
+
+Track the `dev` branch and flag changes touching auth, permissions, token handling, or the CI security backstops. Async post-merge — no gating of in-flight PRs.
+
+What matters more than formal qualifications: fail-closed thinking by default, comfortable reading the auth layer (FastAPI + SQLAlchemy on the backend, a small React surface), willing to push back on `except Exception` shapes in security-sensitive code.
+
+No fixed time commitment. If you're interested — or know someone who fits — email `martin@bambuddy.cool` or DM on Discord.
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.