diff --git a/docs/embed-va.md b/docs/embed-va.md
index 35970f3..7ef0415 100644
--- a/docs/embed-va.md
+++ b/docs/embed-va.md
@@ -36,11 +36,7 @@ VA pushes a JSON payload to the iframe via `window.postMessage` whenever the sel
 
 If VA sends an empty / unmatched message the editor falls back to the unfiltered view but stays in VA mode.
 
-## Security
-
-Only postMessage events from the hosting parent frame (or the same origin in
-dev/tests) are honoured - see [`VaMessagingService.isTrustedSource()`](
-https://git.datacontroller.io/dc/dc/src/branch/main/client/src/app/services/va-messaging.service.ts).
+More logic available in [`va-messaging.service.ts'](https://git.datacontroller.io/dc/dc/src/branch/main/client/src/app/services/va-messaging.service.ts).
 
 ## Configuration in VA