diff --git a/SPEC.md b/SPEC.md
index 96f4d26..d9f7afd 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -313,6 +313,7 @@ Format as structured JSON.
 - **Docstrings:** Required on modules and classes
 - **Logging:** Use `logging` module, no `print()` in production
 - **Pre-commit:** Enforce ruff and pytest before commits
+- **Dependencies:** No pinned versions unless required (e.g., `fastapi` not `fastapi==0.109.0`) - prefer latest for security
 
 ### File Structure
 ```