Security and privacy
This model describes the static product boundary and its residual risks. It is not a security certification and does not claim server-side privacy outside the implemented Netlify and third-party boundaries.
Threat: Another person or extension with access to the browser profile can inspect local data.
Controls: Keep data browser-local; explain shared-device risk; provide deletion and export controls.
Residual risk: Control reduces but does not eliminate risk.
Threat: Selections could reveal civic interests if placed in URLs or telemetry.
Controls: Keep selections out of URLs and analytics; use local state only.
Residual risk: Control reduces but does not eliminate risk.
Threat: A submission can contain voluntary identity or sensitive claims.
Controls: Minimize fields, make contact optional, require transmission notice, keep form output non-public.
Residual risk: Control reduces but does not eliminate risk.
Threat: Fine-grained paths or content events could create civic-interest profiles.
Controls: Require affirmative consent and send only broad route family plus viewport class.
Residual risk: Control reduces but does not eliminate risk.
Threat: Third-party support or payment services have separate data practices.
Controls: Label outbound boundaries; do not imply WS Musings controls the third party.
Residual risk: Control reduces but does not eliminate risk.
Threat: Machine records can be misread as verified findings.
Controls: Use route/indexation controls, readiness terms, provenance, and interpretation boundaries.
Residual risk: Control reduces but does not eliminate risk.
Threat: A compromised dependency or build input can alter public output.
Controls: Pin governed inputs, hash releases, validate deterministically, and perform recovery drills.
Residual risk: Control reduces but does not eliminate risk.
Threat: Untrusted imports can inject markup or corrupt governed records.
Controls: Validate schemas, escape public text, reject unknown fields, and fail closed.
Residual risk: Control reduces but does not eliminate risk.
Threat: A linked authority can redirect, disappear, or become malicious.
Controls: Track resolution, status, stale threshold, owner, and next review; propagate broken state.
Residual risk: Control reduces but does not eliminate risk.