add Security & Privacy appendix per issue w3c#1988

Author: tantek

css-scrollbars-1/Overview.bs

@@ -170,3 +170,82 @@ This appendix is <em>informative</em>.
 This is the First Public Working Draft, no previous draft to describe changes from.
 <!-- This appendix describes changes from the
 <a href="https://www.w3.org/TR/2018/WD-scrollbars-1-2018MMDD/">First Public Working Draft (FPWD) of DD Month 2018</a>.-->
+
+<h2 class="no-num" id="security-privacy-considerations">Appendix C. Considerations for Security and Privacy</h2>
+
+This appendix is <em>informative</em>.
+
+Per the <a href="https://www.w3.org/TR/security-privacy-questionnaire/#questions">
+Self-Review Questionnaire: Security and Privacy: Questions to Consider</a>
+
+<ol>
+<li>Does this specification deal with personally-identifiable information?
+<p>No.</p>
+</li>
+
+<li>Does this specification deal with high-value data?
+<p>No.</p>
+</li>
+
+<li>Does this specification introduce new state for an origin that persists across browsing sessions?
+<p>No.</p>
+</li>
+
+<li>Does this specification expose persistent, cross-origin state to the web?
+<p>No.</p>
+</li>
+
+<li>Does this specification expose any other data to an origin that it doesn’t currently have access to?
+<p>No.</p>
+</li>
+
+<li>Does this specification enable new script execution/loading mechanisms?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to a user’s location?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to sensors on a user’s device?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to aspects of a user’s local computing environment?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin access to other devices?
+<p>No.</p>
+</li>
+
+<li>Does this specification allow an origin some measure of control over a user agent’s native UI?
+<p>Yes. The 'scrollbar-*' properties enable the page to change the color and width of the scrollbar 
+of the user agent’s native UI, e.g. scrollbars on the page’s window, on framed content embedded in the page, 
+or on overflowing elements with scrollbars in the page.</p>
+</li>
+
+<li>Does this specification expose temporary identifiers to the web?
+<p>No.</p>
+</li>
+
+<li>Does this specification distinguish between behavior in first-party and third-party contexts?
+<p>No.</p>
+</li>
+
+<li>How should this specification work in the context of a user agent’s "incognito" mode?
+<p>No differently.</p>
+</li>
+
+<li>Does this specification persist data to a user’s local device?
+<p>No.</p>
+</li>
+
+<li>Does this specification have a "Security Considerations" and "Privacy Considerations" section?
+<p>Yes.</p>
+</li>
+
+<li>Does this specification allow downgrading default security characteristics?
+<p>No.</p>
+</li>
+</ol>