[CSS Gap Decorations] Security and privacy questionnaire for TAG revi…

…ew (#929)

CSSGapDecorations/security-privacy-questionnaire.md

@@ -0,0 +1,76 @@
+# Security and Privacy Questionnaire for CSS Gap Decorations
+
+https://www.w3.org/TR/security-privacy-questionnaire/#questions
+
+## 2.1 What information might this feature expose to Web sites or other parties, and for what purposes is that exposure necessary?
+
+This feature does not expose any new information to Web sites or other parties.
+
+## 2.2 Do features in your specification expose the minimum amount of information necessary to enable their intended uses?
+
+Yes (none).
+
+## 2.3 How do the features in your specification deal with personal information, personally-identifiable information (PII), or information derived from them?
+
+No handling of personal information, PII, or information derived from them.
+
+## 2.4 How do the features in your specification deal with sensitive information?
+
+No handling of sensitive information.
+
+## 2.5 Do the features in your specification introduce new state for an origin that persists across browsing sessions?
+
+No.
+
+## 2.6 Do the features in your specification expose information about the underlying platform to origins?
+
+No.
+
+## 2.7 Does this specification allow an origin to send data to the underlying platform?
+
+No.
+
+## 2.8 Do features in this specification enable access to device sensors?
+
+No.
+
+## 2.9 Do features in this specification enable new script execution/loading mechanisms?
+
+No.
+
+## 2.10 Do features in this specification allow an origin to access other devices?
+
+No.
+
+## 2.11 Do features in this specification allow an origin some measure of control over a user agent’s native UI?
+
+No.
+
+## 2.12 What temporary identifiers do the features in this specification create or expose to the web?
+
+None.
+
+## 2.13 How does this specification distinguish between behavior in first-party and third-party contexts?
+
+No distinction; no special considerations for use of the feature by third-party resources.
+
+## 2.14 How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?
+
+No change to behavior in Private Browsing or Incognito modes.
+No features of the specification that would allow for correlation of a single user's activity across normal and private browsing / incognito modes.
+
+## 2.15 Does this specification have both "Security Considerations" and "Privacy Considerations" sections?
+
+Yes.
+
+## 2.16 Do features in your specification enable origins to downgrade default security protections?
+
+No.
+
+## 2.17 How does your feature handle non-"fully active" documents?
+
+Gap decorations are purely a painted effect and should be handled no differently from existing painted effects such as backgrounds and borders.
+
+## 2.18 What should this questionnaire have asked?
+
+No special considerations for this feature.