diff --git a/README.md b/README.md
index 8a96991..1a3bd48 100644
--- a/README.md
+++ b/README.md
@@ -192,8 +192,7 @@ Opt in with `--mode dataset_included`, or `policy.release_mode` in the project
 The 100 MiB cap applies only to the copied dataset, so it never limits the
 dashboard, and the default never trips it. A project whose parquet is larger than that publishes an identical
 page with `--mode results_only`; what you give up is the ability for someone
-forking it to recompute your numbers from source data, which is why the
-default keeps the data in.
+forking it to recompute your numbers from source data.
 
 ## Fork a published release
 
@@ -301,7 +300,9 @@ with test evidence — including where a criterion was previously asserted too
 generously — is in [`docs/acceptance.md`](docs/acceptance.md).
 
 Requires Node 22+ and pnpm. Ingest additionally needs Docker, an archive RPC
-endpoint, and Postgres 16; everything else runs offline.
+endpoint, and Postgres 16. Once dependencies are installed, building,
+querying and serving run offline; publishing to a remote target and forking
+from a URL need the network.
 
 ## Development
 
diff --git a/docs/security.md b/docs/security.md
index 409a15c..0456ecf 100644
--- a/docs/security.md
+++ b/docs/security.md
@@ -88,5 +88,6 @@ run, by this call.
 
 ## Reporting
 
-Chainplot is an internal tool. Raise anything you find in the repo's issue
-tracker, or directly with the maintainers if it is exploitable.
+Report a vulnerability privately through GitHub: the repository's Security
+tab → Report a vulnerability. Please do not open a public issue for anything
+exploitable. Everything else is welcome in the issue tracker.