diff --git a/README.md b/README.md
index d29eb11..23069b3 100644
--- a/README.md
+++ b/README.md
@@ -5,10 +5,12 @@
 </picture>
 
 <p>
+  <a href="https://www.npmjs.com/package/@flamai/finesse"><img alt="npm version" src="https://img.shields.io/npm/v/@flamai/finesse?style=flat&labelColor=14151A&color=2547F0"></a>
   <img alt="Node 18+" src="https://img.shields.io/badge/node-18%2B-14151A?style=flat&labelColor=14151A&color=2547F0">
   <img alt="Bun and Deno" src="https://img.shields.io/badge/also-Bun%20%C2%B7%20Deno-14151A?style=flat&labelColor=14151A&color=2547F0">
   <img alt="TypeScript types included" src="https://img.shields.io/badge/types-included-14151A?style=flat&labelColor=14151A&color=2547F0">
   <img alt="Status: beta" src="https://img.shields.io/badge/status-beta-14151A?style=flat&labelColor=14151A&color=63656A">
+  <a href="./LICENSE"><img alt="License: Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-14151A?style=flat&labelColor=14151A&color=63656A"></a>
 </p>
 
 # Finesse TypeScript SDK
@@ -47,6 +49,11 @@ and stream it in realtime to voice agents, with a few lines of code.
 - [Request IDs](#request-ids)
 - [Advanced](#advanced)
 - [Runtimes](#runtimes)
+- [Requirements](#requirements)
+- [Versioning](#versioning)
+- [Getting help](#getting-help)
+- [Security](#security)
+- [Contributing](#contributing)
 
 ## Installation
 
@@ -56,8 +63,14 @@ Realtime in Node also needs the `ws` package:
 npm install @flamai/finesse ws
 # or
 pnpm add @flamai/finesse ws
+# or
+yarn add @flamai/finesse ws
+# or
+bun add @flamai/finesse
 ```
 
+`ws` is only needed for realtime in Node. Bun, Deno and browsers have a built-in `WebSocket`.
+
 ## Get an API key
 
 1. Sign in to the [Finesse dashboard](https://finesse.flamapp.ai/dashboard).
@@ -510,6 +523,8 @@ const client = new Finesse({ baseURL: "https://finesse-proxy.example.com" });
 | `logLevel`                | `FINESSE_LOG`        | `"off"`                               |
 | `logger`                  |                      | `console`                             |
 
+An option passed to `new Finesse({...})` always wins over its environment variable.
+
 ### Custom fetch
 
 Pass your own `fetch` for proxies, logging or tests:
@@ -542,11 +557,28 @@ Browsers can't keep an API key secret, so a client holding a key refuses to run
 deprecated URL parameter, because browsers can't set WebSocket headers (as does Deno before
 2.5), and logs a warning once.
 
+## TypeScript types
+
+Every request and response type is exported, so you can type your own code against the API:
+
+```ts
+import type { Voice } from "@flamai/finesse";
+
+function label(voice: Voice) {
+  return `${voice.name} (${voice.id})`;
+}
+```
+
 ## Examples
 
 Runnable scripts are in [`examples/`](./examples): [`speak.ts`](./examples/speak.ts) and
 [`realtime.ts`](./examples/realtime.ts).
 
+## Requirements
+
+- Node 18 or later, Bun, Deno, or a modern browser (see [Runtimes](#runtimes)).
+- TypeScript 4.7 or later, if you use TypeScript.
+
 ## Versioning
 
 The SDK follows [semantic versioning](https://semver.org). Before 1.0, minor versions may
@@ -556,6 +588,18 @@ include breaking changes; they are listed in the [changelog](./CHANGELOG.md).
 import { VERSION } from "@flamai/finesse";
 ```
 
+## Getting help
+
+- [Documentation](https://docs.finesse.flamapp.ai) for guides and the API reference.
+- [GitHub issues](https://github.com/homingos/finesse-node/issues) for bugs and feature requests
+  in this SDK. Include the `requestId` from the error (see [Request IDs](#request-ids)) when
+  a request failed.
+
+## Security
+
+Please don't report security problems in a public issue. See [SECURITY.md](./SECURITY.md) for
+how to report one privately.
+
 ## Contributing
 
 ```sh
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..4abdb92
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,20 @@
+# Security
+
+## Reporting a vulnerability
+
+Please don't open a public issue for a security problem. Report it privately through GitHub
+instead: open the repository's **Security** tab and choose **Report a vulnerability**. Only the
+maintainers can see the report.
+
+Include what you found, how to reproduce it, and the SDK version (`import { VERSION } from
+"@flamai/finesse"`). We'll confirm we received it and keep you updated while we fix it.
+
+## Supported versions
+
+Fixes go into the latest release. Upgrade to it to get them.
+
+## API keys
+
+If you think a Finesse API key has leaked, revoke it in the
+[Finesse dashboard](https://finesse.flamapp.ai/dashboard) under **Settings → API keys** and
+create a new one.
diff --git a/tests/client.test.ts b/tests/client.test.ts
index 51a099b..0e567ae 100644
--- a/tests/client.test.ts
+++ b/tests/client.test.ts
@@ -15,8 +15,8 @@ describe("client", () => {
     vi.stubEnv("FINESSE_API_KEY", "flv_env");
     vi.stubEnv("FINESSE_BASE_URL", "");
     expect(new Finesse().baseURL).toBe(DEFAULT_BASE_URL);
-    vi.stubEnv("FINESSE_BASE_URL", "https://fi.development.flamapis.com/");
-    expect(new Finesse().baseURL).toBe("https://fi.development.flamapis.com");
+    vi.stubEnv("FINESSE_BASE_URL", "https://finesse.example.com/");
+    expect(new Finesse().baseURL).toBe("https://finesse.example.com");
   });
 
   it("sends auth and attribution headers to the right URL", async () => {
diff --git a/tests/live/live.test.ts b/tests/live/live.test.ts
index f9fdb7f..9cc0874 100644
--- a/tests/live/live.test.ts
+++ b/tests/live/live.test.ts
@@ -2,7 +2,7 @@
  * Contract tests against a real Finesse API. Skipped unless FINESSE_LIVE=1.
  *
  *   FINESSE_LIVE=1 FINESSE_API_KEY=flv_... \
- *   FINESSE_BASE_URL=https://fi.development.flamapis.com pnpm vitest run tests/live
+ *   FINESSE_BASE_URL=<non-production API URL> pnpm vitest run tests/live
  *
  * They synthesize a few short sentences (billed per character) and open realtime sessions.
  * They refuse to run against production unless FINESSE_LIVE_ALLOW_PROD=1.