chore: update SECURITY.md

SECURITY.md

@@ -19,3 +19,22 @@ report seriously. You don't need to create a PoC or a patch if that would slow d
 You don't need an elaborate write-up. A short, informal note about the issue is good. We can always
 communicate later to fill in any details we need after that first note is shared with us.
 
+
+## Out of Scope
+
+The following are expected behavior, not vulnerabilities.
+
+### Unauthenticated WebDAV requests list protected directories
+
+An unauthenticated `PROPFIND` lists directory entries, including protected ones. This is required by
+WebDAV clients that send no `Authorization` header until challenged with a `401`; hiding the entries
+would leave them seeing only the public directory, with no way to reach protected ones. Listing a
+name grants no access — reads and writes still return `401`/`403` without credentials.
+
+### XSS from files served by dufs
+
+Files are served inline with their natural content type, including HTML/SVG/XML, so a malicious file
+executes script on *dufs*'s origin. This is not handled because *dufs* exists to serve the files it
+stores: forcing this active content to download broke opening HTML files from the web UI and was
+reverted. Operators are responsible for not hosting untrusted content and for isolating *dufs* on
+its own origin.