[kalfasyan]

• The install line uses the installer's release (releases/latest/download/install.sh), and the read-first note shows how to verify it with gh attestation verify.

• The "Locked down" card now mentions non-root, read-only containers and the scans.

• llms.txt now gives the facts an assistant would otherwise miss:

  • containers: non-root, read-only, no Docker socket, major-version tags
  • accounts: bcrypt, sessions, logs
  • the automated scans and GitHub protections
  • the security policy's times and advisories
  • the pinned, checksummed installer

  It also says plainly that there has been no independent audit.

The layout has no horizontal scroll at 390px. Merge after the first docs release exists; see selfhostit/docs#15.

---

Generated by Claude Code