diff --git a/docs/get-started/launch-token.mdx b/docs/get-started/launch-token.mdx
index bcccc57a8..41495e894 100644
--- a/docs/get-started/launch-token.mdx
+++ b/docs/get-started/launch-token.mdx
@@ -245,6 +245,10 @@ contract DeployToken is Script {
 
 ### Environment Configuration
 
+<Warning>
+Never commit your `.env` file or share your `PRIVATE_KEY`. Always add `.env` to your `.gitignore` to prevent accidental key commits. The raw private key approach shown below is intended for **local development and testing only**. For production deployments, use the more secure keystore method with `cast wallet import deployer --interactive` as described in the [Deploy Smart Contracts guide](https://docs.base.org/get-started/deploy-smart-contracts).
+</Warning>
+
 Create a `.env` file with your configuration:
 
 ```bash .env