The Security Overview exists to explain public trust posture, not to publish a blueprint. It should make clear that DGS treats authentication, workspace access, secrets, and operational monitoring as serious system responsibilities.
Users should expect protected sessions, scoped workspace access, separation between payment handling and application logic where possible, and operational monitoring around important service functions.
Good security documentation explains posture without exposing sensitive implementation detail that would make the service easier to abuse. DGS should stay on that line.