Security defaults

Security defaults

What Sashfold will never do

No telemetry. No sponsored tiles. No default-search auction. No account requirement. No cloud AI. No feature-removal churn. Every setting lives in a human-readable file, and every feature can be turned off.

What the shipped build does by default

Default	What it means
Third-party cookies blocked	The cookie jar stores and sends a cookie only for the site you are on. A request a page makes to another site carries none of that other site's cookies and stores none.
HTTPS-first	A typed host is tried over https first. http is tried once, only when the connection itself fails — never after a certificate error.
Certificate errors have no way through	An expired, self-signed, wrong-host, untrusted-root or revoked certificate lands on an error page with no override, on purpose. The badssl.com matrix is refused.
Referrer policy strict-origin-when-cross-origin	A cross-site request tells the other site which origin you came from, never the full URL.
No default search	A typed non-URL opens an internal page. Nothing is sent to a search engine you did not choose.
Downloads are never opened	A download is saved under a fresh name in the Downloads folder and marked with the mark of the web (the NTFS Zone.Identifier stream, with the source and referrer URLs). Nothing runs.
One network choke point	Every request goes through one fetch(). tools/egress-check.sh fails CI if a socket is opened anywhere else.
An honest user agent	Mozilla/5.0 (<platform>) Sashfold/<version> — no build number, locale or hardware detail, the same for every user of a platform. See Networking.
Content blocking from your own lists	Every request is judged, before it leaves, by the lists in the blocklists folder: filter lists in the Adblock Plus syntax (drop EasyList into blocklists/filters/) refuse what pages request, and their element-hiding rules (##, with the sites they name and the #@# exceptions) hide what gets through, as a stylesheet added to the page; lists of phishing and malware sites (blocklists/nefarious/, as hosts files, one host or URL per line, or the same syntax) keep the shell off those sites as pages too, with a page that names the list and the line and offers no way through. Safe-Browsing-class containment with zero cloud lookups: the lists are files of yours, read at start, and nothing about a visit leaves the machine. Nothing ships in the folder.
Containers keep sites apart	A tab opened in a container (Ctrl+Shift+N, see The shell) has a cookie jar and a web storage of its own: a site you are signed into in one container is a stranger in every other, and nothing a page stores in one can be read from another. The cache is shared.
A page's Content Security Policy is enforced	The Content-Security-Policy headers a page arrives with, and the <meta http-equiv> policies in its head, judge everything the page does: every fetch — scripts, stylesheets, pictures, fonts, fetch() and XMLHttpRequest — before it leaves and again on every redirect hop; every inline script, event handler attribute, <style> and style="" attribute, by 'unsafe-inline', a nonce or a hash ('unsafe-hashes' for the attributes, 'strict-dynamic' as the specification has it); eval, Function and a timer's string by 'unsafe-eval'; a form's target by form-action; a sandbox without allow-scripts runs nothing; upgrade-insecure-requests rewrites http to https. A report-only policy refuses nothing. Every violation is a line on the page's console, once, and no report ever leaves the machine: report-uri and report-to are read and left alone.
A page decides whether it may be framed	A document fetched into an <iframe> is shown only where it allows: by its own policy's frame-ancestors, matched against every document the frame is inside, or — when no enforced policy of its says anything about framing — by X-Frame-Options (DENY; SAMEORIGIN held against the whole chain; values at odds refuse). The page's frame-src decides whether a frame's document is fetched at all, the framed document's own policy governs everything it fetches, and an srcdoc or data: document keeps the policy of the document it is in. A page may show itself in a frame once, but not again inside that; frames go ten deep; and a page's frames are drawn within a budget of a hundred frames and 64 megapixels. A frame's document runs no scripts.

Why zero dependencies is part of this

See The Pledge: nothing is vendored, so there is no supply chain; the OS-shipped TLS on Windows and macOS is patched by the OS; and the import table of every release binary is checked against an allowlist in CI.