add security section and audit link to browser toys portal page

public/browser-toys.html

@@ -141,6 +141,17 @@ xcrun safari-web-extension-converter extensions/safari \
         </ul>
         <p>No data leaves your browser except the messages you choose to send to the public AI endpoints at <code>hermes.ai.unturf.com</code>, <code>qwen.ai.unturf.com</code>, and <code>speech.ai.unturf.com</code>.</p>
 
+        <h3 id="security">Security</h3>
+        <p>The extension code has been audited across 6 security categories with 49 automated tests. Findings: 0 critical, 0 high, 0 medium, 0 low, 3 informational.</p>
+        <ul>
+            <li>No <code>innerHTML</code>, <code>eval()</code>, <code>document.write</code>, or <code>new Function()</code></li>
+            <li>No network requests from extension code (all networking is in the injected uncloseai.js)</li>
+            <li>Minimal permissions: <code>storage</code> only (plus host access for injection)</li>
+            <li>Content Security Policy restricts extension pages to <code>script-src 'self'</code></li>
+            <li>Extension stores exactly one value: <code>{enabled: true|false}</code></li>
+        </ul>
+        <p>📋 <a href="https://github.com/uncloseai/browser-toys/blob/master/docs/security.html" target="_blank"><strong>Read the full Security Audit Report →</strong></a></p>
+
         <h3 id="source">Source Code</h3>
         <p>📦 <a href="https://github.com/uncloseai/browser-toys" target="_blank">github.com/uncloseai/browser-toys</a></p>
         <p>Public domain. No attribution required.</p>
@@ -182,6 +193,7 @@ xcrun safari-web-extension-converter extensions/safari \
                     </li>
                     <li><a href="#how-it-works">How it works</a></li>
                     <li><a href="#storage">Storage & Privacy</a></li>
+                    <li><a href="#security">Security Audit</a></li>
                     <li><a href="#source">Source Code</a></li>
                 </ul>
             </nav>