Move threat model doc to GitHub

Move threat model doc to GitHub
How? (Persistent) XSS?