diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3698d15aa..2327219833 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,22 @@
+# Changelog for [unreleased] (UNRELEASED)
+
+The following sections list the changes for unreleased.
+
+[unreleased]: https://github.com/owncloud/ocis/compare/v1.13.0...master
+
+## Summary
+
+* Security - Don't expose services by default: [#2612](https://github.com/owncloud/ocis/issues/2612)
+
+## Details
+
+* Security - Don't expose services by default: [#2612](https://github.com/owncloud/ocis/issues/2612)
+
+   We've changed the bind behaviour for all non public facing services. Before this PR all
+   services would listen on all interfaces. After this PR, all services listen on 127.0.0.1 only,
+   except the proxy which is listening on 0.0.0.0:9200.
+
+   https://github.com/owncloud/ocis/issues/2612
 # Changelog for [1.13.0] (2021-10-13)
 
 The following sections list the changes for 1.13.0.