Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

docs/SECURITY.md

@@ -57,8 +57,9 @@ nginx — never a development server.
 Content-Security-Policy with `default-src 'none'`, `script-src 'self'` and no `unsafe-inline` or
 `unsafe-eval`; inline style is permitted only as an attribute via `style-src-attr`, which covers the
 dynamic width bars the console uses while still blocking an injected `<style>` element. `connect-src`
-is derived at build time from the same API base URL compiled into the bundle, so the policy cannot
-drift from the origin the bundle calls.
+is the one exact origin derived at build time from the same API base URL compiled into the bundle;
+it deliberately does not include `'self'`. This prevents a dynamic or injected same-origin-derived
+endpoint from becoming an additional network destination when the API is cross-origin.
 
 Also: `X-Content-Type-Options`, `X-Frame-Options`, `Referrer-Policy`,
 `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy` and `Permissions-Policy` — on the entry