From 480794af526b14fc2641412b17bd4c3c6f7c13c8 Mon Sep 17 00:00:00 2001
From: Florian Scholz <fs@florianscholz.com>
Date: Wed, 23 Oct 2024 15:12:25 +0200
Subject: [PATCH 1/2] Add Trusted Types to security group

---
 features/trusted-types.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/features/trusted-types.yml b/features/trusted-types.yml
index 068aa482fb6..2338e9afa81 100644
--- a/features/trusted-types.yml
+++ b/features/trusted-types.yml
@@ -2,5 +2,6 @@ name: Trusted types
 description: Trusted types allow you to lock down insecure parts of the DOM API and prevent client-side cross-site scripting (XSS) attacks.
 spec: https://w3c.github.io/trusted-types/dist/spec/
 caniuse: trusted-types
+group: security
 status:
   compute_from: api.trustedTypes

From 2625d3525aadd02704fe8fdb7910cc077211e5b1 Mon Sep 17 00:00:00 2001
From: Florian Scholz <fs@florianscholz.com>
Date: Tue, 29 Oct 2024 13:25:00 +0100
Subject: [PATCH 2/2] Add security group to more features

---
 features/iframe-credentialless.yml | 1 +
 features/permissions.yml           | 1 +
 features/user-activation.yml       | 1 +
 features/web-cryptography.yml      | 1 +
 4 files changed, 4 insertions(+)

diff --git a/features/iframe-credentialless.yml b/features/iframe-credentialless.yml
index 5c01c4e6473..1bdedcf9fc8 100644
--- a/features/iframe-credentialless.yml
+++ b/features/iframe-credentialless.yml
@@ -1,6 +1,7 @@
 name: Credentialless iframes
 description: The `credentialless` attribute for the `<iframe>` HTML element loads third-party content in an ephemeral context and does not send any credentials such as cookies. When using cross-origin isolation, this allows you to embed content that does not send `Cross-Origin-Embedder-Policy` headers.
 spec: https://wicg.github.io/anonymous-iframe/
+group: security
 compat_features:
   - api.HTMLIFrameElement.credentialless
   - api.Window.credentialless
diff --git a/features/permissions.yml b/features/permissions.yml
index 6bedca514ec..6cd60e0e2dc 100644
--- a/features/permissions.yml
+++ b/features/permissions.yml
@@ -2,3 +2,4 @@ name: Permissions
 description: The `navigator.permissions` API checks whether a permission, such as access to geolocation data, has been granted.
 spec: https://w3c.github.io/permissions/
 caniuse: permissions-api
+group: security
diff --git a/features/user-activation.yml b/features/user-activation.yml
index f25b5e224c4..8c322eab51a 100644
--- a/features/user-activation.yml
+++ b/features/user-activation.yml
@@ -1,3 +1,4 @@
 name: User activation
 description: The `navigator.userActivation` API reveals whether the user has interacted with the page through an "activation" gesture such as a click, tap, or key press. User activation gated APIs (such as the fullscreen API) fail without user interaction, and this API allows you to predict such a failure.
 spec: https://html.spec.whatwg.org/multipage/interaction.html#the-useractivation-interface
+group: security
diff --git a/features/web-cryptography.yml b/features/web-cryptography.yml
index fed680f4b42..63d96cc6d90 100644
--- a/features/web-cryptography.yml
+++ b/features/web-cryptography.yml
@@ -4,6 +4,7 @@ spec:
   - https://w3c.github.io/webcrypto/
   - https://wicg.github.io/webcrypto-secure-curves/
 caniuse: cryptography
+group: security
 status:
   compute_from: api.Crypto
 compat_features: