docs: update for PACT_BROKER_BASE_URL

README.md

@@ -100,7 +100,7 @@ Set the environment variable `PACT_BROKER_LOG_LEVEL` to one of `DEBUG`, `INFO`,
 ## Other environment variables
 
 * `PACT_BROKER_PORT` - the port that the Pact Broker application runs on. Defaults to 9292.
-* `PACT_BROKER_BASE_URL` - optional. If you find that the URLs generated by the API are using an IP instead of a hostname, you can set this environment variable to force the desired base URL. Must include the port if it's a non-standard one. eg. `https://my-broker:9292`. This can also be used if you are mounting the Docker container so that it runs on a non root context eg. `https://my-company.com/pact-broker`. Not that this setting does not change where the application is mounted within the Docker container - it just changes the links.
+* `PACT_BROKER_BASE_URL` - optional but *strongly recommended* when deploying the Pact Broker to production as it prevents some [security vulnerabilities](https://www.cloudflare.com/learning/dns/dns-cache-poisoning/). If you find that the URLs generated by the API are using an IP instead of a hostname, you can set this environment variable to force the desired base URL. Must include the port if it's a non-standard one. eg. `https://my-broker:9292`. This can also be used if you are mounting the Docker container so that it runs on a non root context eg. `https://my-company.com/pact-broker`. Not that this setting does not change where the application is mounted within the Docker container - it just changes the links.
 * `PACT_BROKER_DISABLE_SSL_VERIFICATION` - `false` by default, may be set to `true`.
 * `PACT_BROKER_BASE_EQUALITY_ONLY_ON_CONTENT_THAT_AFFECTS_VERIFICATION_RESULTS` - `true` by default, may be set to `false`.
 * `PACT_BROKER_ORDER_VERSIONS_BY_DATE` - `true` by default. Setting this to false is deprecated.