diff --git a/CHANGELOG.md b/CHANGELOG.md
index d06d7e9..e3de49b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -20,6 +20,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Stream Proxy Allowlist Config**: New `STREAM_PROXY_DOMAINS` env var to override the built-in domain allowlist (comma-separated).
 - **Stream Proxy Referer Config**: New `STREAM_PROXY_REFERER` env var to override the Referer header sent to stream CDNs (default: `https://megaplay.buzz/`).
 
+### Credits
+- **[jamil182](https://github.com/jamil182)** — Reported and fixed the SSRF vulnerability (PR #2), added SECURITY.md (PR #3)
+
 ## [2.4.0] - 2026-08-14
 
 ### Added
diff --git a/README.md b/README.md
index 5923a8f..d9e12eb 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@
   <img src="https://img.shields.io/badge/Version-2.4.1-f43f8e?style=flat-square&logoColor=white" alt="Version"/>
   <img src="https://img.shields.io/badge/Endpoints-38-6366f1?style=flat-square&logoColor=white" alt="Endpoints"/>
   <img src="https://img.shields.io/badge/Anime-10000+-a855f7?style=flat-square&logoColor=white" alt="Anime Database"/>
+  <img src="https://img.shields.io/badge/Maintenance-Active-22c55e?style=flat-square&logo=github&logoColor=white" alt="Maintenance"/>
 </p>
 
 <p align="center">
@@ -2574,6 +2575,12 @@ git push origin feature/amazing-feature
 - [Star History](https://star-history.com/) — GitHub star history charts
 - [Capsule Render](https://github.com/kyechan99/capsule-render) — Header banner generator
 
+### 🔒 Security Contributors
+
+| Contributor | Contribution |
+|:---|:---|
+| [jamil182](https://github.com/jamil182) | Reported & fixed unauthenticated SSRF in stream proxy endpoints (PR #2), added SECURITY.md (PR #3) |
+
 ---
 
 ## 📄 License