docs/vs-nfd/90-restrisiken.md: nine entries, each with risk, why it is
accepted, compensating control and decider — unmarked attachment
content (#212), local auth not yet switchable incl. the open runtime-
flippability question (#216), deferred plugin hash pinning (#232), the
one-time git-history secret check with its pattern caveat (#198),
digest-mail titles (I-23, revisit M32), page_links slug residue (I-24),
the IndexedDB endpoint copy (I-25), deliberately unscheduled features,
and the Site-Admin read bypass. Binding same-PR maintenance rule
stated; referenced from the delimitation statement and consumed by the
Grundschutz mapping.
Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
docs/vs-nfd/50-haertungsleitfaden.md: one adoptable profile — every
entry with the exact switch name, value, default and the reason, split
into instance settings (registration closed, api/mcp off, feeds off,
plugins off, classification defaults vs_nfd + upload block, svg reject,
minimal extension list) and deploy-level configuration (empty
BACKUP_ALLOWED_TARGETS enforces backup-local-only outside Site-Admin
reach; tightened session hours; SMTP deliberately unconfigured with the
consequence stated honestly). auth.local.enabled is listed as the one
pending row (#216) with its compensation until then; the guide states
the binding updated-in-same-PR rule for every future switch. Includes
an operator verification checklist (four unauthenticated 404 curls +
readyz + admin spot checks). Cross-referenced from the delimitation
statement (file names made concrete) and consumed by the Grundschutz
mapping (#230).
Co-Authored-By: Claude Fable 5 (1M context) <noreply@anthropic.com>
