diff --git a/internal/selfip/selfip.go b/internal/selfip/selfip.go
index f89932c..539846c 100644
--- a/internal/selfip/selfip.go
+++ b/internal/selfip/selfip.go
@@ -1,5 +1,10 @@
 // Package selfip discovers the host's current WAN address so the SSRF
 // guard can deny hairpin-NAT fetches of the residential IP.
+//
+// Assumption: the LAN is IPv4-only. A 1.1.1.1 trace only learns v4. If the
+// ISP ever delegates global v6, add interface-derived self prefixes
+// (net.InterfaceAddrs, deny the delegated prefix, default /56) — v6 LAN
+// hosts are then directly reachable with no hairpin NAT.
 package selfip
 
 import (