diff --git a/docs/platforms/javascript/common/sourcemaps/uploading/hosting-publicly.mdx b/docs/platforms/javascript/common/sourcemaps/uploading/hosting-publicly.mdx
index 72dc925726f57..2f7a209f2ff4a 100644
--- a/docs/platforms/javascript/common/sourcemaps/uploading/hosting-publicly.mdx
+++ b/docs/platforms/javascript/common/sourcemaps/uploading/hosting-publicly.mdx
@@ -67,7 +67,7 @@ While the recommended solution is to upload your source artifacts to Sentry, som
 
 If you want to keep your source maps secret and choose not to upload your source maps directly to Sentry, you can enable the “Security Token” option in your project settings.
 
-This will cause outbound requests from Sentry’s servers to URLs originating from your “Allowed Domains” to have the HTTP header `X-Sentry-Token` header append:
+With “Security Token” enabled and “Allowed Domains” not set to `*`, outbound requests from Sentry’s servers to URLs matching “Allowed Domains” will include the HTTP header `X-Sentry-Token`:
 
 ```bash
 GET /assets/bundle.min.js