From aa24c16a22f3625cd169a33229df87859d0a8bd4 Mon Sep 17 00:00:00 2001
From: Nils Lehnen <30603423+iderex@users.noreply.github.com>
Date: Sun, 16 Aug 2026 21:47:17 +0200
Subject: [PATCH] Carry the whole data posture in the security policy, not two
 thirds of it

decisions/data-posture.md names four sections that repeat the posture and says
four things have to survive an edit to any of them: that a server fetching the
file sends nothing about itself or its users, that the hosting provider is named
rather than implied, that the catalogue makes no promise about the plugins it
lists, and that sending data anywhere is something an operator configures rather
than a default.

The section in the security policy carried the first two and stopped. The other
three documents carry all four. This adds the missing two to it.

What that prevents is a reader who opens the security policy first, which is
where somebody goes once they are already worried, and gets a posture that ends
before the two sentences they can act on. It also keeps a wrong reading of the
policy's own scope section: that one decides where a report goes, which is a
different boundary from who answers for what a plugin does with data, so the new
paragraph states the difference rather than restating the section above it.

Named in #49, which this does not close. That issue also asks for the posture in
the operator instruction, and no such document exists yet.

Signed-off-by: Nils Lehnen <30603423+iderex@users.noreply.github.com>
---
 SECURITY.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/SECURITY.md b/SECURITY.md
index d57a4dd..fecfd0d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -64,3 +64,19 @@ GitHub receives each request for them; whatever it keeps is GitHub's under its
 own terms, and this project neither reads it nor adds a record of its own beside
 it. What a server sending one of those requests discloses, and what it does not,
 is in the readme under `## What a server sends when it uses this catalogue`.
+
+The plugins the catalogue lists are separate projects, and what each one does
+with data is its own to describe. Listing one is not a statement about its
+behaviour, so a question about what a plugin sends is that plugin's to answer
+rather than this catalogue's. That is a different boundary from the one under
+`## What is out of scope` above, which decides where a report goes rather than
+who answers for a behaviour.
+
+Personal data stays on the operator's own host unless the operator configures a
+plugin to send it somewhere, which is something set up deliberately and never a
+default. What that looks like, so that a reader can tell whether they have done
+it: another server's address entered in a setting, an invitation issued to
+somebody outside the household, a synchronisation target pointed at a machine
+that is not yours. If none of that has been configured, nothing has left the
+host, and whether a particular plugin offers any of it is that plugin's own
+documentation.