diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f35cbc2
--- /dev/null
+++ b/README.md
@@ -0,0 +1,8 @@
+Requires your Forgejo instance admin to enable CORS for at least the
+origin which serves the notification panel. Please see
+[here](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#cors-cors)
+for more information.
+
+NOTE: The test [forgejo configuration](./integration/conf/app.ini) may
+be insecure for your usecase since it allows CORS for all origins with
+the widest possible surface.