Security Policy

Supported versions

Falco is a hobby / research browser engine. Security fixes are applied only to the latest release line.

Version	Supported
latest	✅
< latest	❌

Please do not file public issues for security vulnerabilities.

Instead, please report them privately:

We will acknowledge within 72 hours and aim to ship a fix within 30 days for high-severity issues.

Falco is not a production browser. It is a small engine intended for learning, headless rendering, and embedding in tooling. In particular:

Falco does not yet enforce a complete same-origin policy in its render pipeline. The security/ module implements the spec algorithms but they are not fully wired into the renderer.
Falco does not yet run JS in a sandboxed process.
Falco's HTML/CSS/JS parsers are not hardened against malicious input that attempts to exploit parser bugs to escape the engine.

Do not use Falco to render untrusted content in a security-sensitive context. Treat Falco the way you would treat a research prototype.

Items we know we need (in priority order):

Wire security::origin SOP checks into the DOM and fetch pipeline.
Run the JS engine in a child process with security::sandbox seccomp filters applied.
Site-isolation: one renderer process per origin (see security::process).
CSP enforcement in the HTML parser / script runner (see security::csp::allows_inline_script).
TLS certificate validation by default on HTTPS fetches (see security::cert::validate_chain).