diff --git a/Reverse-proxy-configurations.md b/Reverse-proxy-configurations.md
index 8a850d3..52c16d0 100644
--- a/Reverse-proxy-configurations.md
+++ b/Reverse-proxy-configurations.md
@@ -50,6 +50,14 @@ example.com {
 
 The [linuxserver/swag](https://docs.linuxserver.io/general/swag) image includes ready-made snippets for MeTube in [subfolder](https://github.com/linuxserver/reverse-proxy-confs/blob/master/metube.subfolder.conf.sample) and [subdomain](https://github.com/linuxserver/reverse-proxy-confs/blob/master/metube.subdomain.conf.sample) modes, plus Authelia for authentication.
 
+## Why no built-in authentication?
+
+MeTube deliberately has no login system (see #931): authentication done right
+is substantial, security-sensitive complexity, and every reverse proxy above
+adds it in minutes with battle-tested code. Use HTTP basic auth, Authelia,
+or your proxy's equivalent. Anything security-related can be reported via the
+repository's private vulnerability reporting (see SECURITY.md).
+
 ---
 
 Have a working config for another proxy (Traefik, nginx-proxy-manager, HAProxy…)? [Open an issue](https://github.com/alexta69/metube/issues) with the snippet and it will be added here with attribution.
diff --git a/YTDL_OPTIONS-Cookbook.md b/YTDL_OPTIONS-Cookbook.md
index 072b794..e70600e 100644
--- a/YTDL_OPTIONS-Cookbook.md
+++ b/YTDL_OPTIONS-Cookbook.md
@@ -47,3 +47,18 @@ NOTE: due to the complex usage of quotes here (both `"` and `'` are used), it's
                      "add_metadata": false,
                      "key": "FFmpegMetadata"}]}
 ```
+
+## Notifications on download completion
+
+The image includes `curl`, and yt-dlp's `Exec` postprocessor runs a command
+after each successful download — enough for ntfy, Gotify, Pushover, Telegram,
+webhooks, etc.:
+
+    YTDL_OPTIONS={"postprocessors":[{"key":"Exec","exec_cmd":"curl -s -d 'Downloaded: ' -d %(title)q https://ntfy.sh/YOUR_TOPIC","when":"after_move"}]}
+
+`exec_cmd` supports the full yt-dlp output-template syntax (`%(title)q`,
+`%(filepath)q`, ...). To make notifications opt-in per download instead of
+global, define it as a named preset via `YTDL_OPTIONS_PRESETS`.
+
+Note: postprocessors only run on **success** — there is currently no hook for
+failed downloads.