Disable external file access by default

1 files changed, 6 insertions, 5 deletions

diff --git a/README.md b/README.md
index 616f0a7..3d5a613 100644
--- a/README.md
+++ b/README.md
@@ -291,9 +291,9 @@ Converts the source document to HTML.
   pass `include_default_style_map=False`.
 
 * Source documents may reference files outside of the source document.
-  To disable access to any such external files during the conversion process,
-  pass `external_file_access=False`.
-  This is highly recommended when converting untrusted user input.
+  Access to any such external files is disabled by default.
+  To enable access when converting trusted source documents,
+  pass `external_file_access=True`.
 
 * `convert_image`: by default, images are converted to `<img>` elements with the source included inline in the `src` attribute.
   Set this argument to an [image converter](#image-converters) to override the default behaviour.
@@ -420,8 +420,9 @@ For instance:
   and embed the HTML into your website,
   this may allow arbitrary files on the server to be read and exfiltrated.
 
-  To disable access to any such external files during the conversion process,
-  pass `external_file_access=False`.
+  To avoid this issue, access to any such external files is disabled by default.
+  To enable access when converting trusted source documents,
+  pass `external_file_access=True`.
 
 ### Document transforms