Docs: cut repeated claims from the README and the security overview

README.md

@@ -16,7 +16,7 @@
 <sub><i>Note: The first demo visit may take up to a minute due to Render's free-tier cold start.</i></sub>
 
 Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a calm, launcher-style grid of app tiles, folders, and a small number of
-*genuinely useful* widgets, running in a single container with no external services or dependencies. Built to be glanced at a hundred times a day without feeling cluttered.
+*genuinely useful* widgets, running in a single container. Built to be glanced at a hundred times a day without feeling cluttered.
 
 ## Contents
 
@@ -40,8 +40,7 @@ Most dashboards are a wall of numbers and charts. Stackyard is the opposite: a c
 - **Configured by clicking, not by editing files.** Everything is set up in the web UI, with config import and export.
 - **No dependencies.** Review it once and stop worrying about the supply chain.
 
-Launcher-style grid of app links, folders, and widgets, with a mobile layout.
-Available in English, Persian, Chinese, Spanish, German, and French.
+Has a mobile layout, and is available in English, Persian, Chinese, Spanish, German, and French.
 
 ## Getting started
 

docs/security.md

@@ -2,9 +2,7 @@
 
 ## Network exposure
 
-Stackyard does not terminate TLS and serves traffic over plain HTTP only. While login attempts are rate-limited, the application is **not** designed or hardened for direct exposure to the public internet. Authentication exists primarily to simplify management of multiple local dashboards and should not be relied on as an internet-facing security boundary.
-
-Deploy Stackyard only on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls. Do **not** expose it directly to the internet or make it accessible via port forwarding.
+Stackyard does not terminate TLS and serves traffic over plain HTTP only. Login attempts are rate-limited, but the application is **not** designed or hardened for direct exposure to the public internet: authentication exists to simplify management of multiple local dashboards, and is not an internet-facing security boundary. Deploy it on a trusted network, or behind a reverse proxy that terminates TLS and provides its own authentication and access controls.
 
 
 ## HTTPS and the session cookie
@@ -187,10 +185,10 @@ which proves only that something signed the image.
 Each release build also scans the image with Trivy before publishing it and
 fails on a HIGH or CRITICAL finding that has a fix available, so a flagged image
 never reaches a registry. The scan covers `linux/amd64`; `linux/arm64` is built
-by emulation and cannot be scanned before it is pushed. The build also produces
-an SPDX SBOM listing
-what is inside it. The SBOM is attached to the build as an artifact, downloadable
-from the run's summary page on GitHub.
+by emulation and cannot be scanned before it is pushed.
+
+The build also produces an SPDX SBOM listing what is inside the image, attached
+to the run as an artifact and downloadable from its summary page on GitHub.
 
 Images are published to `ghcr.io/sandobserver/stackyard`. A Docker Hub mirror is
 published alongside it when the project has credentials configured; ghcr.io is