Security self-review answers for 9 July 2024 WD of IFT

[svgeesus]

Self-Review Questionnaire: Security and Privacy

This questionnaire has moved.

For your convenience, a copy of the questionnaire's questions is quoted here in Markdown, so you can easily include your answers in an explainer.

1. What information might this feature expose to Web sites or other parties,
   and for what purposes is that exposure necessary?

None

2. Do features in your specification expose the minimum amount of information
   necessary to enable their intended uses?

Yes, we believe that they do.

3. How do the features in your specification deal with personal information,
   personally-identifiable information (PII), or information derived from
   them?

No personal information is transferred

4. How do the features in your specification deal with sensitive information?

No sensitive information is transferred

5. Do the features in your specification introduce new state for an origin
   that persists across browsing sessions?

No

6. Do the features in your specification expose information about the
   underlying platform to origins?

No

7. Does this specification allow an origin to send data to the underlying
   platform?

No. Web fonts are never installed on the underlying system; they are used without installation.

8. Do features in this specification enable access to device sensors?

No.

9. What data do the features in this specification expose to an origin? Please
   also document what data is identical to data exposed by other features, in the
   same or different contexts.

None

10. Do features in this specification enable new script execution/loading
    mechanisms?

No

11. Do features in this specification allow an origin to access other devices?

No

12. Do features in this specification allow an origin some measure of control over
    a user agent's native UI?

No

13. What temporary identifiers do the features in this specification create or
    expose to the web?

None

14. How does this specification distinguish between behavior in first-party and
    third-party contexts?

No difference.

15. How do the features in this specification work in the context of a browser’s
    Private Browsing or Incognito mode?

Such modes may elect to not request any WebFonts, in which case they will not use this specification.

16. Does this specification have both "Security Considerations" and "Privacy
    Considerations" sections?

Yes

17. Do features in your specification enable origins to downgrade default
    security protections?

No

18. How does your feature handle non-"fully active" documents?

Non-"fully active" documents will not trigger font subset extension requests.

19. What should this questionnaire have asked?

Nothing springs to mind.