docs: document cache modes and security settings

Update README and .env.example with:
- Cache mode descriptions (disk, memory, hybrid, none)
- Security settings table (ALLOWED_DOMAINS, ALLOWED_ORIGINS)
- Production configuration example

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: adiologydev

.env.example

@@ -2,15 +2,23 @@
 PORT=3000
 
 # Cache settings
-CACHE_MODE=disk              # Cache mode: "disk" | "memory" | "none" (default: disk)
-CACHE_DIR=./cache            # Directory for disk cache (only used when CACHE_MODE=disk)
+# Cache modes:
+#   disk   - Persist to disk only (survives restarts)
+#   memory - In-memory only (fastest, lost on restart)
+#   hybrid - Memory (L1) + Disk (L2) for speed and persistence
+#   none   - No caching
+CACHE_MODE=disk
+CACHE_DIR=./cache            # Directory for disk cache (disk/hybrid modes)
 CACHE_TTL=86400              # Cache TTL in seconds (default: 24 hours)
 MAX_CACHE_SIZE=1073741824    # Max cache size in bytes (default: 1GB, disk mode only)
-MAX_MEMORY_CACHE_ITEMS=1000  # Max items in memory cache (default: 1000, memory mode only)
+MAX_MEMORY_CACHE_ITEMS=1000  # Max items in memory cache (memory/hybrid modes)
 BROWSER_CACHE_TTL=31536000   # Browser cache TTL in seconds (default: 1 year)
 
 # Security
-ALLOWED_DOMAINS=             # Comma-separated list of allowed domains (empty = allow all)
+ALLOWED_DOMAINS=             # Comma-separated source image domains (empty = allow all)
+                             # Example: example.com,cdn.example.com
+ALLOWED_ORIGINS=             # Comma-separated CORS origins (empty = allow all)
+                             # Example: https://example.com,https://app.example.com
 MAX_IMAGE_SIZE=10485760      # Max image size in bytes (default: 10MB)
 REQUEST_TIMEOUT=30000        # Request timeout in ms (default: 30s)
 

README.md

@@ -250,6 +250,35 @@ BROWSER_CACHE_TTL=31536000  # 1 year
 TEMPLATES_DIR=./templates
 ```
 
+### Cache Modes
+
+| Mode     | Description                                                                 |
+| -------- | --------------------------------------------------------------------------- |
+| `disk`   | Persist to disk only. Survives restarts but slower reads.                   |
+| `memory` | In-memory LRU cache. Fastest but lost on restart.                           |
+| `hybrid` | Memory (L1) + Disk (L2). Fast reads with persistence. Best for production.  |
+| `none`   | No caching. Every request processes the image fresh.                        |
+
+### Security Settings
+
+| Variable          | Description                                                                                           |
+| ----------------- | ----------------------------------------------------------------------------------------------------- |
+| `ALLOWED_DOMAINS` | Restricts which domains can be used as image sources. Supports subdomains (e.g., `example.com` allows `cdn.example.com`). |
+| `ALLOWED_ORIGINS` | Restricts which origins can make CORS requests. Use full URLs (e.g., `https://example.com`).          |
+
+**Example configuration for production:**
+
+```bash
+# Only allow fetching images from your domain
+ALLOWED_DOMAINS=example.com
+
+# Only allow your frontend to make requests
+ALLOWED_ORIGINS=https://example.com,https://app.example.com
+
+# Use hybrid cache for best performance
+CACHE_MODE=hybrid
+```
+
 ## Custom Templates
 
 Create JSON template files in the `templates/` directory: