AW8 — Finalize release security, privacy, network, storage, and resilience audit

[joris97jansen]

Description

Perform the final release audit for security-adjacent behavior, network hardening, cache/cookie/storage boundaries, resilience, and production failure behavior.

This issue should not claim complete browser security. It should verify that the static engine’s documented behavior is bounded, deterministic, and not obviously unsafe within its scope.

The goal is to make release safety claims honest and limited.

Requirements

• Audit URL/origin handling.

• Audit fetch/network error handling.

• Audit redirects and redirect limits.

• Audit cache key/storage boundary behavior.

• Audit cookie domain/path/Secure/SameSite/credentials behavior.

• Audit storage quota/eviction/clearing behavior.

• Audit resource size limits.

• Audit response header/body limits.

• Audit decompression/encoding limits where supported.

• Audit malformed input resilience.

• Audit panic/crash hardening.

• Audit diagnostics for unsupported security features.

• Confirm unsupported features are explicitly listed:

  • full CORS;

  • CSP;

  • mixed-content blocking;

  • HSTS;

  • certificate UI;

  • process isolation;

  • site isolation;

  • Service Workers;

  • browser sandbox;

  • full privacy model.

• Add release safety/resilience report.

• Add known security limitations section.

• Ensure production builds do not enable unsafe debug-only assumptions.

• Add tests or checklist entries for critical resilience paths.

Exit Criteria

• Release security/resilience audit is complete.

• Network/storage/cookie boundaries are documented.

• Known security limitations are explicit.

• Production guardrails are verified.

• Unsupported security/platform features are not silently claimed.

• Release safety report exists.

• The issue is closeable without claiming full browser security.