Updates

docs/security-privacy.md

@@ -2,9 +2,11 @@
 
 The default posture is local inference, explicit writes, and fail-closed
 computer use. No telemetry or cloud inference is required. Model endpoints
-stay on localhost. Public `web_search` and `web_fetch` are allowed by default
-without a confirmation prompt. Shell commands that open public HTTP (curl,
-wget) remain blocked by the runtime; use the web tools instead.
+stay on localhost. Public `web_search`, `google_search`, `fetch_page`,
+`web_fetch`, `wiki_search`, `hn_search`, and `code_search` are allowed by
+default without a confirmation prompt and without extra API keys. There is no
+SearXNG dependency. Shell commands that open public HTTP (curl, wget) remain
+blocked by the runtime; use the web tools instead.
 
 ```mermaid
 flowchart TD
@@ -15,7 +17,7 @@ flowchart TD
   C -->|no| B[Block and explain]
   X --> A[Audit metadata]
   X --> D[Return result]
-  L[Lock screen] --> K[Revoke CU + mute overlay]
+  L[Lock screen] --> K[Revoke CU + mute HUD]
 ```
 
 ## Protected assets