diff --git a/deltachat-jsonrpc/src/api/types/appversions.rs b/deltachat-jsonrpc/src/api/types/appversions.rs
index 8ab45418c..52e8d3c91 100644
--- a/deltachat-jsonrpc/src/api/types/appversions.rs
+++ b/deltachat-jsonrpc/src/api/types/appversions.rs
@@ -13,6 +13,8 @@ pub struct JsonrpcAppSource {
     pub version_string: String,
 
     /// Where to download that version.
+    /// Security note: consumers need to verify themselves 
+    /// that downloaded app files are valid before installing them.
     pub download_url: String,
 }