document and add to changelog the 'sensitive_command' hook

CHANGELOG.md

@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - plugins: plugins can now suggest `lightning-cli` default to -H for responses.
 - Plugin: new notification `forward_event` offered/settled/failed/local_failed.
 - contrib: new `bootstrap-node.sh` to connect to random mainnet nodes.
+- plugins: new hook `sensitive_command` which allows a plugin to take over the execution of sensitive RPC commands.
 
 ### Changed
 

doc/PLUGINS.md

@@ -619,6 +619,26 @@ processed before the HTLC was forwarded, failed, or resolved, then the plugin
 may see the same HTLC again during startup. It is therefore paramount that the
 plugin is idempotent if it talks to an external system.
 
+#### sensitive_command
+
+This hook is called whenever a "sensitive" command is sent via RPC. It will send the name
+of the command to the plugin, which will decide if the execution of the command can continue
+by responding "continue" to the hook. Any other response will fail the RPC call.
+```json
+"sensitive_command": {
+	"command": "sendpay"
+}
+```
+Are considered sensitives:
+- txsend
+- withdraw
+- close
+- all fundchannels
+- disconnect (for force)
+- sendpay
+- stop
+- all dev commands because internals.
+
 [jsonrpc-spec]: https://www.jsonrpc.org/specification
 [jsonrpc-notification-spec]: https://www.jsonrpc.org/specification#notification
 [bolt4]: https://github.com/lightningnetwork/lightning-rfc/blob/master/04-onion-routing.md