SECURITY & TRANSPARENCY
Protection backed by evidence.
See what has been tested, what each check covers, and what remains before public release.
Dated snapshot: 2026-09-12T06:33:51.898200+00:00. Results below describe this snapshot, not a live security assessment. This is not a security certification or a production download approval.
A missing deployment delay means no verified deployment has been recorded. Upstream partial rollouts are also tracked: 154.0.8037.17. Version numbers alone do not prove security-patch coverage.
Scroll across to read every column. With a keyboard, focus this table area and use the left and right arrow keys.
| Check | Recorded status | Scope and limits |
|---|---|---|
| Upstream security coverage | not verified | The official stable baseline commit is not in the local source history. Security-patch coverage remains unverified; version numbers and Git ancestry do not prove it. |
| Publisher signing | required | Production publisher certificate/provider approval and verified signed binaries are required. |
| Engineering checks | passed | 71 security-tool tests; source and log bindings verified. Dependency findings and browser tests are reported separately. |
| Updater security tests | passed | 20 Go tests passed in the bound log. This covers the updater implementation; production signing and clean-machine installation remain separate gates. |
| Homepage and server tests | passed | 24 homepage/server tests; current sources and test log verified. Local website tests do not approve public DNS, TLS or a browser release. |
| Dependency scan | findings | 13 dependency records checked; 1 advisory groups. Reachability exclusions do not silently clear this gate. Scope: updater Go modules and homepage npm lockfile. Chromium engine coverage is separate. |
| Native privacy tests | not verified | A result from the last 24 hours bound to the current native sources, XML, test executable and component DLLs and test log is required. |
| Native extension tests | not verified | A result from the last 24 hours bound to the current native sources, XML, test executable and component DLLs and test log is required. |
| Extension integration tests | not verified | A result from the last 24 hours bound to the current extension integration sources, fixtures, runner and binary and test log is required. |
| Signed desktop deployment | required | The signed update feed and browser package must pass public HTTPS validation against the released artifact. Publishing this website does not complete that check. |
| Clean Windows installation | required | A clean-machine installation, update and recovery run is not established by local unit tests. |
| Independent external assessment | not commissioned | Internal agent reviews and automated tests are engineering evidence, not independent certification. |
Privacy, extensions and AI boundaries
Protected workspaces use separate browser profiles and explicit extension approval. Site exceptions deliberately reduce tracker filtering for that exact site. Approved extensions retain the powers granted to them. Separate profiles do not protect against malware running as the same operating-system user.
Privileged inherited AI services are disabled in CAQA source, including automation overrides. Native test status is listed above. An ordinary AI website receives the content you choose to send to it, subject to that service's policies.
Code signing policy
Public releases require a configured trusted publisher identity, protected release keys, signed TUF metadata and artifact verification. Free signing services have their own eligibility and approval requirements. No signing provider sponsorship or approval is claimed at this stage.
Open-source foundations
CAQA uses Chromium and its existing Mozilla Readability integration. The update client uses The Update Framework. OSV-Scanner checks selected build dependencies. Brave's adblock-rust remains an evaluated candidate; it is not represented as integrated.
- Results describe the tested source and artifacts at the stated time; they do not certify future changes.
- No claim is made that CAQA is more secure than every other browser.
- At generation, passing engineering results require matching source and artifact bindings and timestamps within 24 hours. This dated snapshot does not refresh automatically; rerun validation before a release.
- Privileged inherited AI services are disabled in CAQA source. The named native suites above have limited scope; full browser lifecycle and adversarial integration evidence remain required.
Evidence generated 2026-09-12T06:33:51.898200+00:00. Download the public evidence summary.