diff --git a/README.md b/README.md
index cab13ee..2d403c7 100644
--- a/README.md
+++ b/README.md
@@ -24,7 +24,9 @@ Secret loading order:
 0. Hardcoded values. **This is purely for debugging, prototyping, and for
    configuring below options.**
 1. Files pointed to by environment variables. Docker friendly.
-2. Secrets folder. Also Docker friendly.
+2. Secrets folder. Also Docker friendly. Defaults to `secrets`, but can be
+   configured through the `SECRETS_DIRECTORY` key (NOTE: passed directly,
+   rather than through a file.)
 3. [Pass: the standard unix password
    manager](https://www.passwordstore.org/). Most suited for personal
    usage; very unsuited for server environments. Requires `pass` installed
@@ -50,6 +52,7 @@ Secret loading order:
 - [ ] Vault:
   * [ ] Ensure vault code path works.
   * [ ] Document usage and requirements.
+- [ ] Get inspiration from <https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html>
 
 
 # License
diff --git a/setup.py b/setup.py
index b2ab1a6..ddf4dbe 100644
--- a/setup.py
+++ b/setup.py
@@ -31,7 +31,9 @@ Secret loading order:
 0. Hardcoded values. **This is purely for debugging, prototyping, and for
    configuring below options.**
 1. Files pointed to by environment variables. Docker friendly.
-2. Secrets folder. Also Docker friendly.
+2. Secrets folder. Also Docker friendly. Defaults to `secrets`, but can be
+   configured through the `SECRETS_DIRECTORY` key (NOTE: passed directly,
+   rather than through a file.)
 3. [Pass: the standard unix password
    manager](https://www.passwordstore.org/). Most suited for personal
    usage; very unsuited for server environments. Requires `pass` installed
@@ -57,6 +59,7 @@ Secret loading order:
 - [ ] Vault:
   * [ ] Ensure vault code path works.
   * [ ] Document usage and requirements.
+- [ ] Get inspiration from <https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html>
 """.strip()
 
 PACKAGE_DESCRIPTION_SHORT = """