diff --git a/src/everything/README.md b/src/everything/README.md
index c924689468..fe41f51f8b 100644
--- a/src/everything/README.md
+++ b/src/everything/README.md
@@ -17,7 +17,7 @@ The resource collections (`demo://resource/collection/summer-specials`, and the
 
 The server info and every tool, prompt, resource and resource template carry a pair of [icons](docs/features.md#icons), one for a light theme and one for a dark theme, so a client can show the variant that suits its own background.
 
-The `get-env` tool returns the server's environment variables, but masks the value of any credential-like name (a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment, such as `OPENAI_API_KEY`) as `"<redacted>"`. To see every value unmasked while debugging, start the server with `GET_ENV_INCLUDE_SECRETS=1` (or `true`). Leave it unset otherwise: with it set, every credential in the server's environment reaches the model's context.
+The `get-env` tool returns the server's environment variables, but masks the value of any credential-like name (one with a `KEY`, `TOKEN`, `SECRET`, `PASSWORD`, `PASSWD`, `CREDENTIAL`, `AUTH` or `COOKIE` segment between underscores, in any case: whole segments, not substrings, so `OPENAI_API_KEY` is masked and `APIKEY` is not) as `"<redacted>"`. To see every value unmasked while debugging, start the server with `GET_ENV_INCLUDE_SECRETS=1` (or `true`). Leave it unset otherwise: with it set, every credential in the server's environment reaches the model's context.
 
 ## Protocol versions