• Webpage content and downloads are untrusted input.
• Browser state remains in the app container; downloads are Files-visible.
• Distributors own their signing, entitlements, and security review.

For the public repository, use GitHub's Report a vulnerability action under the Security tab. It creates a private security advisory visible only to the reporter and repository maintainers. Do not post exploit details in a public issue. If GitHub private reporting is temporarily unavailable, email hello@prifina.com with the subject Personal Browser security report and include the minimum information needed to establish a private follow-up. No response-time or support SLA is promised. Do not include unrelated credentials, browsing data, or personal details in reports. This source snapshot has no hosted backend or managed Apple entitlement.