diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go
index 786c3529b..71e36020b 100644
--- a/cmd/kosli/root.go
+++ b/cmd/kosli/root.go
@@ -177,8 +177,8 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file,
 	templateFileFlag                = "[optional] The path to a yaml template file. Cannot be used together with --use-empty-template"
 	templateFileSimpleFlag          = "[optional] The path to a yaml template file."
 	useEmptyTemplateFlag            = "Use an empty template for the flow creation without specifying a file. Cannot be used together with --template or --template-file"
-	attestationUserDataFlag         = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation."
-	trailUserDataFlag               = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail."
+	attestationUserDataFlag         = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB."
+	trailUserDataFlag               = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail. The maximum JSON payload size is 1MB."
 	gitCommitFlag                   = "[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd, otherwise defaults to HEAD )."
 	buildUrlFlag                    = "The url of CI pipeline that built the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )."
 	commitUrlFlag                   = "The url for the git commit that created the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )."
@@ -265,7 +265,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file,
 	attestationCompliantFlag        = "[defaulted] Whether the attestation is compliant or not."
 	attestationRepoRootFlag         = "[defaulted] The directory where the source git repository is available. Only used if --commit is used or defaulted in CI, see https://docs.kosli.com/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables ."
 	attestationCustomTypeNameFlag   = "The name of the custom attestation type."
-	attestationCustomDataFileFlag   = "The filepath of a json file containing the custom attestation data."
+	attestationCustomDataFileFlag   = "The filepath of a JSON file containing the custom attestation data. The maximum JSON payload size is 1MB."
 	uploadJunitResultsFlag          = "[defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not."
 	uploadSnykResultsFlag           = "[defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not."
 	attestationAssertFlag           = "[optional] Exit with non-zero code if the attestation is non-compliant"
diff --git a/cmd/kosli/testdata/output/docs/mintlify/snyk.md b/cmd/kosli/testdata/output/docs/mintlify/snyk.md
index ea0c2580e..317a7c0c8 100644
--- a/cmd/kosli/testdata/output/docs/mintlify/snyk.md
+++ b/cmd/kosli/testdata/output/docs/mintlify/snyk.md
@@ -65,7 +65,7 @@ In other CI systems, set them explicitly to capture repository metadata.
 | `-R`, `--scan-results` | string | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault. |
 | `-T`, `--trail` | string | The Kosli trail name. |
 | `--upload-results` | bool | [defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not. (default true) |
-| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. |
+| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. |
 
 
 ## Examples Use Cases
diff --git a/go.mod b/go.mod
index dd8bd3d29..a5fd06f2b 100644
--- a/go.mod
+++ b/go.mod
@@ -242,7 +242,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.55.0 // indirect
+	golang.org/x/crypto v0.56.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
 	golang.org/x/mod v0.38.0 // indirect
 	golang.org/x/net v0.58.0 // indirect
diff --git a/go.sum b/go.sum
index d203fafb7..38522714c 100644
--- a/go.sum
+++ b/go.sum
@@ -605,8 +605,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
 go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
+golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
+golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM=
 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=