Updates

docs/security-privacy.md

@@ -1,8 +1,10 @@
 # Security and privacy
 
-The default posture is local-only, explicit, and fail-closed. No telemetry or
-cloud inference is required. The network policy rejects unexpected outbound
-model or tool traffic; optional model-fetch features remain user initiated.
+The default posture is local inference, explicit writes, and fail-closed
+computer use. No telemetry or cloud inference is required. Model endpoints
+stay on localhost. Public `web_search` and `web_fetch` are allowed by default
+without a confirmation prompt. Shell commands that open public HTTP (curl,
+wget) remain blocked by the runtime; use the web tools instead.
 
 ```mermaid
 flowchart TD