diff --git a/sdks/advanced/client-side-signing.mdx b/sdks/advanced/client-side-signing.mdx
index c71956f6..55740239 100644
--- a/sdks/advanced/client-side-signing.mdx
+++ b/sdks/advanced/client-side-signing.mdx
@@ -4,6 +4,10 @@ title: "Client-side signing"
 
 This guide covers how to set up client-side signing using Turnkey's `@turnkey/iframe-stamper` package and the `export-and-sign` iframe. This architecture enables secure transaction and message signing directly in the browser without exposing private keys to your application code. Note that mishandling of exported private keys introduces inherent risks; please proceed with caution.
 
+<Note>
+  Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later.
+</Note>
+
 ## Overview
 
 Client-side signing allows you to:
diff --git a/sdks/advanced/iframe-stamper.mdx b/sdks/advanced/iframe-stamper.mdx
index 520e5db0..aa894e9b 100644
--- a/sdks/advanced/iframe-stamper.mdx
+++ b/sdks/advanced/iframe-stamper.mdx
@@ -10,6 +10,10 @@ It leverages the `postMessage` communication mechanism to send and receive messa
 
 By bridging the gap between the iframe's isolated environment and Turnkey's API, the iframe stamper plays a pivotal role in maintaining the integrity and security of the credential while ensuring seamless operation within the iframe context.
 
+<Warning>
+  Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later. The import flow requires `organizationId` and `userId` in the injected import bundle; bundles that omit these fields are rejected with an `ERROR`.
+</Warning>
+
 ## Installing
 
 To start using the `@turnkey/iframe-stamper` client, install it as follows:
diff --git a/snippets/shared/export-wallets.mdx b/snippets/shared/export-wallets.mdx
index d4db0192..9058b354 100644
--- a/snippets/shared/export-wallets.mdx
+++ b/snippets/shared/export-wallets.mdx
@@ -69,6 +69,10 @@ A full reference implementation is available at
 
 ### Embedded iframe
 
+<Note>
+  Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later.
+</Note>
+
 Turnkey hosts a static export page at `export.turnkey.com` designed to be embedded as an iframe in
 your app. The encrypted bundle returned by Turnkey is injected into the iframe, which decrypts and
 displays the mnemonic or private key entirely within its own origin — neither your app nor Turnkey
diff --git a/snippets/shared/import-wallets.mdx b/snippets/shared/import-wallets.mdx
index 60f3116e..470ba795 100644
--- a/snippets/shared/import-wallets.mdx
+++ b/snippets/shared/import-wallets.mdx
@@ -72,6 +72,10 @@ A full reference implementation is available at
 
 ### Embedded iframe
 
+<Warning>
+  Versions of `@turnkey/iframe-stamper` below 2.0.0 are vulnerable to cross-origin attacks. If you are using an older version, upgrade to 2.0.0 or later. The import flow requires `organizationId` and `userId` in the injected import bundle; bundles that omit these fields are rejected with an `ERROR`.
+</Warning>
+
 Turnkey hosts a static import page at `import.turnkey.com` designed to be embedded as an iframe in
 your app. The iframe handles encryption of the mnemonic or private key entirely within its own
 origin — neither your app nor Turnkey ever sees the plaintext. Use