diff --git a/worklets/Overview.bs b/worklets/Overview.bs index 8d40fcce..78ea8c3b 100644 --- a/worklets/Overview.bs +++ b/worklets/Overview.bs @@ -13,6 +13,7 @@ Editor: Ian Kilpatrick, ikilpatrick@chromium.org
 urlPrefix: http://heycam.github.io/webidl/; type: dfn;
     text: AbortError
+    text: SecureContext
     text: SyntaxError
     urlPrefix: #idl-;
         text: DOMException
@@ -41,6 +42,7 @@ urlPrefix: https://html.spec.whatwg.org/multipage/webappapis.html; type: dfn;
     text: event loop
     text: event loop processing model
     text: fetch a module script tree
+    text: fetch a single module script
     text: global object
     text: https state
     text: incumbent settings object
@@ -410,7 +412,28 @@ loops and callbacks exceeding imposed time limits.
 Security Considerations {#security-considerations}
 ==================================================
 
-Issue(w3c/css-houdini-drafts#92): Need to decide if to allow worklets for unsecure context, etc.
+Worklets do not introduce any usable API surface to the web themselves, instead other
+specifications, e.g. [[css-paint-api-1]], [[webaudio]] will extend this specification to provide
+useful functionality.
+
+Specifications which use worklets should decide if their worklet(s) should be allowed outside
+SecureContexts.
+
+Worklets load their module scripts in the same manner that workers load their module scripts. This
+fetches the top-level script by the fetch a single module script algorithm which sets the
+mode to "cors".
+
+Issue(w3c/css-houdini-drafts#378): Provide hook for downstream specifications to provide their
+    destination type.
+
+The specifications which extend/use worklets may have additional security considerations.
+
+Privacy Considerations {#privacy-considerations}
+================================================
+
+There are no known privacy impacts for this feature by itself.
+
+The specifications which extend/use worklets may have privacy considerations.
 
 Examples {#examples}
 ====================