Release API Tools 0.2.0

docs/PRIVACY-SECURITY.md

@@ -1,12 +1,17 @@
 # Privacy and security
 
 Descriptions and exchanges remain in memory and are never transmitted or
-persisted. All remote/absolute `$ref` forms fail closed. Displayed URLs are text,
-not links. There is no Try It button, OAuth flow, DNS lookup, HTTP execution,
-telemetry or external asset.
+persisted. All remote/absolute `$ref` forms fail closed. Displayed URLs, broker
+hosts, channel addresses, protocol bindings, and generated commands are text,
+not live controls. There is no Try It button, broker connection, subscription,
+publish action, OAuth flow, DNS lookup, HTTP execution, telemetry, or external
+asset.
 
 HAR and saved exchanges commonly contain tokens, cookies, personal data and
-payloads. The summary does not render header values, yet the source editor still
-contains them. Clear it before sharing. Generated examples are heuristic and
-must not be treated as valid production data. Validation and compatibility
-checks cover a useful subset, not every OpenAPI or JSON Schema rule.
+payloads. Header and cookie values may be used transiently to check parameter
+presence and shape, and JSON bodies may be parsed for local schema checks, but
+the summary and contract report never retain or render those values. The source
+editor still contains the original capture; clear it before sharing. Generated
+examples are heuristic and must not be treated as valid production data.
+Validation and compatibility checks cover a useful bounded subset, not every
+OpenAPI or JSON Schema rule.