diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md
index c82010a6..c65c7b72 100644
--- a/docs/trust-boundary/security.md
+++ b/docs/trust-boundary/security.md
@@ -185,8 +185,15 @@ token policy bounds file reads; network isolation bounds network reach.
 
 **What's NOT exposed**:
 
-- `/home/<name>/.claude/` — mode `0700`, owned by the per-agent
-  user `<name>`. nixbld users can't read it.
+- `/home/<name>/.claude/` — `.credentials.json`, `history.jsonl` and
+  `settings.json` are `0600`; `projects/` and `sessions/` are `0700`. All owned
+  by the per-agent user `<name>`, so nixbld users can't read any of them.
+  ⚠️ The **directory itself is `0755`**, on purpose: `hive-core` is a different
+  user and needs read+execute to list it so `claude_has_session` can detect a
+  valid session (`ensure_claude_dir`, `hive-c0re/src/lifecycle/setup.rs`).
+  The per-file mode is therefore the whole protection here — anything added to
+  this directory at a default mode is world-readable, which isn't
+  hypothetical: `plugins/` and `.last-cleanup` already are.
 - `$HYPERHIVE_STATE_DIR/forge-token` (= `/agents/<name>/state/forge-token`)
   — written at mode `0600` and chowned to the per-agent uid:gid (see
   `hive-c0re/src/forge/mod.rs`'s module doc for exactly where). nixbld users