Update Security and privacy considerations

Expand "Request User Consent" considerations, add "Limit API Usage" considerations and suggested mitigations per W3C Security review feedback: w3c/security-request#71
w3c · anssiko · Oct 28, 2024 · Oct 24, 2024 · Oct 24, 2024 · Oct 25, 2024
commit 7d644a2ffa518460fdbcdcd65cc9d4ffcb5e0e5e
diff --git a/index.html b/index.html
@@ -239,7 +239,15 @@ <h2>
       <p>
         For these reasons, the <a>user agent</a> SHOULD inform the user when
         the API is being used and provide a mechanism to disable the API
-        (effectively no-op), on a per-origin basis or globally.
+        (effectively no-op), on a per-origin basis or globally. Implementers
+        are encouraged to complement the normatively defined sticky
+        activation-based user activation-gating mitigation with the
+        above-mentioned <a>implementation-defined</a> mitigations.
+      </p>
+      <p>
+        The <a>user agent</a> SHOULD employ global rate limiting to restrict
+        the number of vibration requests made within a certain period
+        (e.g., per minute or hour) to prevent excessive use.
       </p>
     </section>
     <section class='informative'>