diff --git a/README.md b/README.md
index 8e1c7fe..c95a35f 100644
--- a/README.md
+++ b/README.md
@@ -31,15 +31,13 @@ Run `git fat init` to activate the extension. Now add and commit as usual.
 Matched files will be transparently stored externally, but will appear
 complete in the working tree.
 
+## rsync remote
+
 Set a remote store for the fat objects by editing `.gitfat`.
 
     [rsync]
     remote = your.remote-host.org:/share/fat-store
 
-This file should typically be committed to the repository so that others
-will automatically have their remote set. This remote address can use
-any protocol supported by rsync. 
-
 Most users will configure it to use remote ssh in a directory with shared 
 access. To do this, set the `sshuser` and `sshport` variables in `.gitfat` 
 configuration file. For example, to use rsync with ssh, with the default
@@ -59,7 +57,20 @@ Edit your .gitfat file and add the following:
     key={access_key_id}
     secret={secret_access_key}
 
-And then you're done.
+And then you're done. 
+
+## Distributing .gitfat
+
+This file (.gitfat) should typically be distributed to other users of the repository.
+For the rsync backend, no identification information is stored, and .gitfat
+can be committed to the repository so that others
+will automatically have their remote set. This remote address can use
+any protocol supported by rsync. 
+
+For the S3 backend, it is more complicated. 
+If the repository is (or will ever be) hosted publicly, do not commit .gitfat into the repository.
+Doing so will expose your S3 identity to the world, and anybody can modify the files
+hosted on the S3 bucket. Distribute the file via a secure channel instead. 
 
 # A worked example
 
@@ -80,7 +91,7 @@ First, we create a repository and configure it for use with `git-fat`.
     remote = localhost:/tmp/fat-store
     $ mkdir -p /tmp/fat-store               # make sure the remote directory exists
     $ echo '*.gz filter=fat -crlf' > .gitattributes
-    $ git add .gitfat .gitattributes
+    $ git add .gitfat .gitattributes        # do not add .gitfat if S3 backend is used.
     $ git commit -m'Initial repository'
     [master (root-commit) eb7facb] Initial repository
      2 files changed, 3 insertions(+)