2 files changed, 17 insertions, 0 deletions

diff --git a/docs/dev/README.md b/docs/dev/README.md
index b91013f13..57162a47d 100644
--- a/docs/dev/README.md
+++ b/docs/dev/README.md
@@ -226,6 +226,9 @@ If the GitHub Actions release fails because of a transient problem like a timeou
 If it fails because of something that needs to be fixed, remove the release tag (if needed), fix the problem, then start over.
 Make sure to remove the new changelog post created when running `cargo xtask release` a second time.
 
+We release "nightly" every night automatically and promote the latest nightly to "stable" manually, every week.
+We don't do "patch" releases, unless something truly egregious comes up.
+
 # Permissions
 
 There are three sets of people with extra permissions:
diff --git a/docs/user/manual.adoc b/docs/user/manual.adoc
index dba2197de..8656dd1da 100644
--- a/docs/user/manual.adoc
+++ b/docs/user/manual.adoc
@@ -516,6 +516,20 @@ See https://github.com/rust-analyzer/rust-project.json-example for a small examp
 
 You can set `RA_LOG` environmental variable to `rust_analyzer=info` to inspect how rust-analyzer handles config and project loading.
 
+== Security
+
+At the moment, rust-analyzer assumes that all code is trusted.
+Here is a **non-exhaustive** list of ways to make rust-analyzer execute arbitrary code:
+
+* proc macros and build scripts are executed by default
+* `.cargo/config` can override `rustc` with an arbitrary executable
+* VS Code plugin reads configuration from project directory, and that can be used to override paths to various executables, like `rustfmt` or `rust-analyzer` itself.
+* rust-analyzer's syntax trees library uses a lot of `unsafe` and hasn't been properly audited for memory safety.
+
+rust-analyzer itself doesn't access the network.
+The VS Code plugin doesn't access the network unless the nightly channel is selected in the settings.
+In that case, the plugin uses the GitHub API to check for and download updates.
+
 == Features
 
 include::./generated_features.adoc[]