From a3e7a9fc9c5f32bb5befec8049e3b9c2ebfcdc8c Mon Sep 17 00:00:00 2001
From: bunnie <bunnie@kosagi.com>
Date: Mon, 8 Jun 2026 23:59:32 +0800
Subject: [PATCH] add note documenting app-keys feature gate

---
 services/keystore/Cargo.toml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/services/keystore/Cargo.toml b/services/keystore/Cargo.toml
index 4488ccf8a..10516bee7 100644
--- a/services/keystore/Cargo.toml
+++ b/services/keystore/Cargo.toml
@@ -83,6 +83,9 @@ debug-hal = ["bao1x-hal/debug-print-duart"]
 owc-inc = ["keystore-api/owc-inc"]
 
 # Enable to allow users to access the application keystore slots
+# Because application keys are stored adjacent to secret keys, it's recommended to leave this
+# feature off if it's not actively being used by the target application, as it reduces the
+# potential attack surface exposed by the keystore server.
 app-keys = ["keystore-api/app-keys"]
 
 board-baosec = [