Present the repo as a scoped bookmarks API product and drop homelab-only notes.

SECURITY.md

@@ -0,0 +1,16 @@
+# Security
+
+This add-on is scoped to bookmarks. Treat a leaked `fab_…` secret like a password for your bookmark tree: revoke it, then issue a new one.
+
+## Boundaries that must stay
+
+- Manifest permissions: `bookmarks`, `storage`, `nativeMessaging` only
+- No `tabs`, `history`, `cookies`, `<all_urls>`, `webRequest`, or `runtime.onMessageExternal`
+- Host bind: `127.0.0.1`
+- Reject HTTP requests that carry a browser `Origin`
+- Native host `allowed_extensions` pinned to this gecko id
+- Method allowlist in both `extension/background.js` and `host/firefox_agent_bridge_host.py`
+
+## Reporting
+
+Please open an issue on this repository. Do not attach live secrets or a copy of `places.sqlite`.