Security Model

Strict Mode Protocol

Zepra Browser — Strict Mode Security Policy

Zepra operates in Strict Mode by default, prioritizing:

  • User privacy
  • Predictable behavior
  • Performance stability
  • Reduced attack surface

Strict Mode is designed to prevent abuse while preserving core web functionality.

🛡️ Strict Web Rules

Strict Mode protects users from:

  • Cross-site tracking
  • Cookie theft
  • Malicious redirects
  • Spam prompts and overlays
  • UX manipulation

🚫 Content Policy

Blocked or Restricted Content

Content TypeActionReason
Third-party cookiesBLOCKTracking prevention
Popup windowsRequire user gestureAnti-spam
Auto-playing mediaMuted by defaultUX protection
Audio playbackRequires user gestureAbuse prevention
Notification prompts1 per sessionAnti-spam
DownloadsRequire user gestureMalware prevention
Redirect chainsMax 3 hopsAnti-phishing

📢 Ad Behavior Policy

Zepra enforces behavior-based ad rules at the engine level, not ad blocking via lists.

Ad BehaviorAction
Overlay ads (cover content)BLOCK
Interstitial ads (pre-content)BLOCK
Auto-expanding adsBLOCK
Fake close buttonsBLOCK
Inline static adsALLOW
Sidebar adsALLOW

🔒 Cookie Policy

  • Default: First-party only
  • Third-party: BLOCKED
  • SameSite: Strict (default)
  • HttpOnly: Enforced for sensitive cookies
  • Partitioning: Per top-level origin

Cookie Theft Prevention

  • No document.cookie access in cross-origin contexts
  • Cookie access restricted to same-site frames
  • Automatic expiry heuristics for tracking behavior

📜 ZepraScript Restrictions

Blocked or Restricted APIs (Strict Mode)

document.cookie;                 // Blocked in cross-origin
window.open();                   // Requires user gesture
Notification.requestPermission();// Limited calls
navigator.geolocation;           // Coarse accuracy only

Rate-Limited APIs

  • alert(): 3 per page
  • confirm(): 3 per page
  • prompt(): 1 per page
  • window.open(): 1 per gesture

⚙️ Implementation Model

ContentPolicy Interface

class ContentPolicy {
public:
    enum class Mode { Strict, Compatible };

    bool allowThirdPartyCookies() const;
    bool allowPopups() const;
    bool allowAutoplayMuted() const;
    bool allowAudioPlayback() const;
    int maxRedirects() const;
};
HomeDocsCommunityBlog