Virgin

Security

What Virgin refuses to do.

These are enforced invariants, not aspirations. The list below them is the part most projects hide.

  1. 01

    Sandbox escapes abort startup

    QTWEBENGINE_DISABLE_SANDBOX, --no-sandbox and --disable-sandbox all stop the browser from launching rather than degrading quietly.

  2. 02

    Private windows leave no records

    They never write Virgin history or session records, and their native WebEngine profile is destroyed after the last private window closes.

  3. 03

    Certificates fail closed

    Certificate errors reject by default. Only main-frame errors that Qt marks overridable can reach an explicit override dialog.

  4. 04

    Downloads are never auto-executed

    Files are sanitized and uniquely named, and suspicious extensions require confirmation.

  5. 05

    No silent handoff to other apps

    Remote pages cannot launch external applications without a user link gesture and explicit confirmation.

  6. 06

    Filter lists are bounded data

    Remote scriptlets are not executed, corrupt caches are rejected, and active rules swap atomically.

  7. 07

    Identities do not share storage

    Each normal, container and private identity uses a different QWebEngineProfile storage boundary.

Known release boundaries

The 0.1.0 preview does not claim these.

  • Bundled filter files are offline bootstrap rules. Virgin fetches current EasyList/EasyPrivacy at startup when saved subscriptions are missing or older than seven days; View → Update Filter Lists forces a refresh.
  • Qt WebEngine does not expose complete per-origin deletion for every storage type. The UI states when an action must clear profile-wide cookies and cache.
  • HTTPS-first upgrades before navigation. A polished explicit HTTP fallback interstitial is still future work.
  • Browser compatibility and security regression testing still need real desktop lab coverage before any 1.0 claim.
  • The real EasyList/EasyPrivacy miss-heavy benchmark is above the desired blocker budget. That is a measured optimization target, not an achievement.
  • No password manager, cloud sync, extension compatibility layer, custom TLS/network stack, or agent API is included.

The local agent API from the design document is intentionally not exposed. Browser automation over authenticated sessions needs a separately reviewed capability and IPC security model, so it waits until after stability.

Read SECURITY.md