Follow up on intent behind documenting what the user can / cannot expect in terms of security

[AOrthVector]

The project MUST document what the user can and cannot expect in terms of security from the software produced by the project (its "security requirements").