docs(security): air-gap claims vs network exposure (A4 / AAP-82838)

[sudhirverma]

Summary

Closes finding A4 (air-gap / privacy messaging vs network exposure) after secure-default work in AAP-82788 (DR-030) and AAP-82804 (DR-029).

Product copy previously emphasized air-gap and data privacy while historical defaults exposed HTTP on all interfaces, plaintext gRPC off-loopback, and wildcard CORS—so an air-gapped admin could wrongly treat network isolation as security. This PR aligns docs/README/feature text with the implemented localhost-first posture and explicitly states what is and is not protected.

What changed

• Add docs/SECURITY.md as the air-gap / privacy source of truth:
  • Default bind 127.0.0.1, required HTTP auth, CORS allowlist (never *)
  • gRPC TLS required off-loopback (or explicit --insecure)
  • No network isolation controls as a product feature (operator/environment owns firewall/air-gap networking)
  • Residual risks when air-gapped; operator-facing exposure controls (bind, auth, CORS, TLS, consumers)
• Align README, Getting Started, Configuration, Container, Architecture, Product Overview, Landscape, Red Hat AI, VS Code README, and Roadmap so none claim that isolation alone secures Abbenay
• Record DR-038 in docs/decisions.md
• Operator checklist (bind, auth, CORS, TLS, consumers, MCP) and Unreleased changelog notes for AAP-82788 / AAP-82804

Finding mapping

Issue	Posture documented
H1 — HTTP on 0.0.0.0	Default bind 127.0.0.1
C1 — Wildcard CORS	Explicit allowlist + auth
C2 — Plaintext gRPC when exposed	TLS / fail-closed off-loopback
No network isolation controls	Not a product feature; document real daemon controls
Isolation ≠ security	Explicit callouts + residual risks

Depends on

• AAP-82788 — secure-by-default HTTP (DR-030)
• AAP-82804 — fail-closed gRPC TLS (DR-029)

Test plan

• Fresh default daemon start: HTTP on 127.0.0.1, auth required; see docs/SECURITY.md / docs/CONFIGURATION.md
• gRPC policy matches AAP-82804 (loopback plaintext OK; non-loopback needs --grpc-tls or --insecure)
• Read air-gap / privacy docs: no claim that network isolation alone secures Abbenay
• Confirm product/README/feature links point at docs/SECURITY.md
• Walk operator checklist: bind, auth, CORS, TLS, consumers, MCP
• Changelog/release notes call out AAP-82788 / AAP-82804 secure-default changes

Related

• Finding: A4
• Jira: AAP-82838
• Decision: DR-038

[cidrblock]

Rebased onto latest main and resolved conflicts with #89 auth-off wording:

• Kept the current ABBENAY_HTTP_AUTH=0 on any bind guidance (cluster / reverse-proxy cases)
• Preserved the A4 air-gap / SECURITY.md callouts
• Inserted DR-038 ahead of DR-039 / DR-041 / DR-042
• Fixed PR description typos (residual, see)

CI should re-run on 6602414. Thanks for the docs work — this should be merge-ready once checks are green.