From d504ea2549f3583653525d7f7db291efc7d5ba42 Mon Sep 17 00:00:00 2001
From: Dan Zucker <49076749+dzucker-tab@users.noreply.github.com>
Date: Thu, 17 Sep 2026 13:13:23 -0700
Subject: [PATCH] adding security note for mac debugging (#650)

---
 website/docs/debug/trex_debugging.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/website/docs/debug/trex_debugging.md b/website/docs/debug/trex_debugging.md
index bd8ea1e1..73438ba6 100644
--- a/website/docs/debug/trex_debugging.md
+++ b/website/docs/debug/trex_debugging.md
@@ -113,6 +113,12 @@ The remote debugging port (for example, `8696`) must match the port address you
 
 :::
 
+:::important
+
+If using the `QTWEBENGINE_REMOTE_DEBUGGING` environment variable to enable remote debugging, **unset it when done**. Leaving this variable set allows unauthenticated remote access to your extension’s runtime, creating a remote code execution vulnerability.
+
+:::
+
 ---
 
 ## Debugging Tableau Desktop using Chrome/Chromium