diff --git a/proposals/privacy-threat-model.html b/proposals/privacy-threat-model.html
index 1256592..494758c 100644
--- a/proposals/privacy-threat-model.html
+++ b/proposals/privacy-threat-model.html
@@ -10,6 +10,7 @@
     <script src="utils.js" class="remove"></script>
     <script class='remove'>
       var respecConfig = {
+	  github: "w3c/webpayments",
           status: "MEMBER-SUB",
           maxTocLevel: 3,
           editors: [{
@@ -149,6 +150,10 @@ <h2>
         cards (e.g., business and personal) belong to the same individual, the
         user should make use of two profiles.
         </li>
+        <li>Although "private browsing mode" may help mitigate some of the
+        threats described here, we do not consider it a sufficient mitigation
+        strategy.
+        </li>
         <li>Most browsers are moving in the direction of double-keyed
         partitioning, whatever the storage mechanism.
         </li>