diff --git a/config.example.scfg b/config.example.scfg
index 5c3e5e4ff8452643ed462be5a8d494f9c4499d18..59a04ad1644103962c89fb9c498e64d1035b3666 100644
--- a/config.example.scfg
+++ b/config.example.scfg
@@ -3,23 +3,31 @@ # listen-addr tcp://localhost:8080
 listen-addr unix://var/run/cerrado.sock
 
 root-readme /srv/git/README.md
+syntax-highlight monokailight
+
+# if passphrase is empty the whole authentication, private/public repository
+# and login UI will be disabled, and only public repository will be displayed.
 passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
 aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
-syntax-highlight monokailight
 
+# repository section is order dependent where the first repository has priority
+# in case of conflict. Repository has also priority over scan. The order
+# between scan and repository is irrelevant which means that all repository
+# sections will be read first then all the scans.
+repository /srv/git/cerrado.git {
+    name cerrado
+    description "Self host single person forge"
+    public true
+}
 
+# scan is order dependent where first scan has priority in case of conflict. So
+# if you add another scan section bellow that scan the same folders it will be
+# ignored.
 scan /srv/git/private {
     public false
 }
 
 scan /srv/git/ {
-    public true
-}
-
-
-repository /srv/git/cerrado.git {
-    name cerrado
-    description "Self host single person forge"
     public true
 }