@@ -84018,8 +84018,22 @@ interface <dfn interface>BarProp</dfn> {
    exchange, and explicit `<code>Cross-Origin-Resource-Policy</code>` is not required. Other
    requests sent with credentials requires the server's explicit permission through the <span>CORS
    protocol</span> or the `<code>Cross-Origin-Resource-Policy</code>` header.</p></dd>
+
   </dl>
 
+  <div class="warning">
+   <p>Before supporting "<code data-x="coep-credentialless">credentialless</code>", implementers are
+   strongly encouraged to support both:
+   <ul>
+    <li><a href="https://wicg.github.io/private-network-access/">Private Network Access</a>.
+    <li><a href="https://github.com/annevk/orb">Opaque Response Blocking</a>.
+   </ul>
+   <p>Otherwise, it would let attackers to leverage client's network position to read non public
+   resources by default, using the <span
+   data-x="concept-settings-object-cross-origin-isolated-capability">cross-origin isolated
+   capability</span>.</p>
+  </div>
+
   <p>An <span>embedder policy value</span> is <dfn>compatible with cross-origin isolation</dfn> if it
   it either "<code data-x="coep-credentialless">credentialless</code>" or "<code
   data-x="coep-require-corp">require-corp</code>".</p>