Update README.md

README.md

@@ -60,32 +60,6 @@ Once enabled on one or more tabs, your AI assistant can:
 
 The MCP will automatically start a relay server and connect to your enabled browser tabs.
 
-## Security
-
-Playwriter is designed with security in mind, ensuring that only you can control your browser.
-
-### How It Works
-
-1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988`
-2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server
-3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs)
-4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection
-5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated
-
-### What Can Be Controlled
-
-- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon
-- **New tabs created by automation**: Tabs created programmatically through Playwright commands
-- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible
-
-### What Cannot Happen
-
-- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only)
-- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected
-- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually
-
-This architecture ensures that browser automation only happens with your explicit permission on tabs you choose.
-
 ### Using with Playwright
 
 You can use playwriter programmatically with playwright-core:
@@ -148,3 +122,29 @@ Navigation:
 - `browsermcp_browser_press_key` - Press a key on the keyboard
   Utilities:
 - `browsermcp_browser_wait` - Wait for a specified time in seconds
+
+## Security
+
+Playwriter is designed with security in mind, ensuring that only you can control your browser.
+
+### How It Works
+
+1. **Local WebSocket Server**: When the MCP starts, it launches a singleton WebSocket server on `localhost:19988`
+2. **Dual Connection**: Both the Chrome extension and MCP client connect to this local server
+3. **User-Controlled Access**: The extension can only control tabs where you explicitly clicked the extension icon (green icon indicates connected tabs)
+4. **Localhost-Only**: The WebSocket server does not send CORS headers, preventing any web pages or remote servers from connecting to it - only processes running on your local machine can establish a connection
+5. **Explicit Consent**: Chrome displays an "automation banner" on controlled tabs, making it obvious when a tab is being automated
+
+### What Can Be Controlled
+
+- **Only enabled tabs**: Tabs you explicitly connected by clicking the extension icon
+- **New tabs created by automation**: Tabs created programmatically through Playwright commands
+- **Nothing else**: Other browser tabs, your browsing history, or any tabs you haven't explicitly connected remain inaccessible
+
+### What Cannot Happen
+
+- **No remote access**: External websites or servers cannot connect to the WebSocket (localhost-only)
+- **No passive monitoring**: The extension cannot read or monitor tabs you haven't connected
+- **No automatic spreading**: The debugger won't automatically attach to new tabs you open manually
+
+This architecture ensures that browser automation only happens with your explicit permission on tabs you choose.