Add security questionnaire template

Author: tomayac

README.md

@@ -383,6 +383,8 @@ The Cache API is fundamentally modeled around the concepts of `Request` or URL s
 
 AI models are admittedly the biggest motivation for working on COS, so one alternative would be to solve the problem exclusively for AI models, for example, by offering a storage mechanism on the `self.ai.*` namespace that Chrome is experimenting with in the context of built-in AI APIs like the [Prompt API](https://github.com/webmachinelearning/prompt-api) proposal. Two questions arise in the context: First, how would it be enforced that files are really AI models? Second, `self.ai.*` is explicitly focused on built-in AI APIs where the model is provided by the browser and not by the developer. Given this background, this approach doesn't seem like a great fit, and, maybe more importantly, the non-AI [use cases](#use-cases) are well worth solving, too.
 
+## Security and privacy considerations
+
 ## Stakeholder feedback / opposition
 
 - **Web Developers**: Positive feedback for enabling sharing large files without repeated downloads and storage, particularly in the context of huge AI models, SQLite databases, offline storage archives, and large Wasm modules.

security-questionnaire.md

@@ -0,0 +1,89 @@
+# [Self-Review Questionnaire: Security and Privacy](https://w3ctag.github.io/security-questionnaire/)
+
+## 01. What information does this feature expose, and for what purposes?
+
+
+
+## 02. Do features in your specification expose the minimum amount of information necessary to implement the intended functionality?
+
+
+
+## 03. Do the features in your specification expose personal information, personally-identifiable information (PII), or information derived from either?
+
+
+
+## 04. How do the features in your specification deal with sensitive information?
+
+
+
+## 05. Does data exposed by your specification carry related but distinct information that may not be obvious to users?
+
+
+
+## 06. Do the features in your specification introduce state that persists across browsing sessions?
+
+
+
+## 07. Do the features in your specification expose information about the underlying platform to origins?
+
+
+
+## 08. Does this specification allow an origin to send data to the underlying platform?
+
+
+
+## 09. Do features in this specification enable access to device sensors?
+
+
+
+## 10. Do features in this specification enable new script execution/loading mechanisms?
+
+
+
+## 11. Do features in this specification allow an origin to access other devices?
+
+
+
+## 12. Do features in this specification allow an origin some measure of control over a user agent's native UI?
+
+
+
+## 13. What temporary identifiers do the features in this specification create or expose to the web?
+
+
+
+## 14. How does this specification distinguish between behavior in first-party and third-party contexts?
+
+
+
+## 15. How do the features in this specification work in the context of a browser’s Private Browsing or Incognito mode?
+
+
+
+## 16. Does this specification have both "Security Considerations" and "Privacy Considerations" sections?
+
+
+
+## 17. Do features in your specification enable origins to downgrade default security protections?
+
+
+
+## 18. What happens when a document that uses your feature is kept alive in BFCache
+
+
+
+## 19. What happens when a document that uses your feature gets disconnected?
+
+
+
+## 20. Does your spec define when and how new kinds of errors should be raised?
+
+
+
+## 21. Does your feature allow sites to learn about the user's use of assistive technology?
+
+
+
+## 22. What should this questionnaire have asked?
+
+