diff --git a/changelog.d/909-inbound-share-transport-identity.security.md b/changelog.d/909-inbound-share-transport-identity.security.md
new file mode 100644
index 00000000..2334d5b7
--- /dev/null
+++ b/changelog.d/909-inbound-share-transport-identity.security.md
@@ -0,0 +1 @@
+An inbound room share and a room-scoped line are now trusted by the transport that delivered them, not by the envelope that describes them: a share naming a room of yours is refused (`not-inviter`) unless it arrives from the home the room belongs to, a line for a room nobody shared no longer opens one (`unknown-room`), and a `@handle` signature is shown only when it traces to the sending Bot, a remote seat of that room or its inviter — otherwise the line is kept and attributed to the Bot that delivered it, marked unverified ([#909](https://github.com/ThinkFlowLab/FlyBot/issues/909)).