Ferowen by Enzonic

Ferowen Security Policy

Effective: November 8, 2026

We want Ferowen to be safe to use, and we welcome reports from anyone who finds a security problem in it. This policy explains what is in scope, how to report an issue, and what you can expect from Enzonic.

Scope

In scope

  • The Ferowen app for macOS, Windows and Linux, current release (version 0.2 as of this policy). Examples: address-bar or URL spoofing, data from macOS private windows being written to disk, bypasses of HTTPS-Only mode or of Ferowen Shield's request blocking on Windows and Linux, macOS downloads saved without the quarantine attribute, weak permissions on Ferowen's local data files, or the app sending data anywhere our Privacy Policy says it does not.
  • The website browser.enzonic.com, including the integrity of the Ferowen download files served from it.

Out of scope

  • Vulnerabilities in the web engines themselves. Report WebKit and macOS issues to Apple through its product security reporting process. Report Servo or SpiderMonkey issues to the Servo project, following the security policy in its GitHub repository (https://github.com/servo/servo). If an engine bug affects Ferowen in a way it does not affect other browsers using that engine, or if Ferowen's bundled copy of Servo is out of date, tell us too.
  • Cloudflare's own infrastructure, the search providers Ferowen offers, and any other third-party website or service.
  • Gaps in Ferowen Shield's block list. You can still tell us about missed trackers at security@enzonic.com, but we treat them as ordinary bugs.
  • Features that Ferowen does not offer on a platform, such as private windows on Windows and Linux.
  • Attacks that require physical access to an unlocked computer, or an attacker who already controls your user account.
  • Denial-of-service attacks, spam, social engineering and phishing of Enzonic staff.
  • Automated scanner output with no demonstrated impact, such as missing headers on static pages.
  • Old versions of Ferowen that have been superseded.

How to report

Email security@enzonic.com with:

  • the Ferowen version, and the operating system and its version, that you tested;
  • a description of the issue and its impact;
  • steps to reproduce it, or a proof of concept;
  • whether and how you would like to be credited.

Please do not include other people's personal data in your report.

Testing guidelines

  • Test only on your own computer, your own installation and your own data.
  • Do not access, change or delete data that belongs to someone else.
  • Do not degrade browser.enzonic.com, for example with high-volume automated scanning.
  • Do not modify the hosted download files or distribute modified builds to others.
  • Give us reasonable time to fix an issue before you disclose it publicly.

Safe harbor

If you act in good faith and follow this policy:

  • we consider your research authorized;
  • we will not take or support legal action against you for it, including under anti-hacking laws or for reverse engineering the Ferowen app to the extent your research requires;
  • if someone else takes legal action against you over research that followed this policy, we will make it known that your work was authorized by us.

This safe harbor covers Enzonic's systems and software only. We cannot authorize testing of systems run by Apple, the Servo project, Cloudflare, search providers or any other third party. If you are unsure whether something is allowed, ask us first at security@enzonic.com.

What we commit to

  • Acknowledge your report within 3 business days.
  • Give you an initial assessment within 10 business days.
  • Keep you informed as we investigate and fix the issue.
  • Fix confirmed issues as quickly as we reasonably can, prioritized by severity.
  • Coordinate disclosure with you. We ask for up to 90 days, or until a fix is released if that is sooner, and we are open to a different timeline when the situation calls for it.
  • Credit you in our release notes or advisory, if you want to be named.
  • Announce security fixes on browser.enzonic.com, since Ferowen does not yet check for updates automatically.

No bug bounty yet

Enzonic does not offer a paid bug bounty at this time. We offer public credit for valid reports. If we start a bounty program, we will announce it here.

Staying safe as a user

  • On macOS, keep macOS up to date. WebKit, the engine Ferowen uses there, receives its security fixes through macOS updates.
  • On Windows and Linux, keep Ferowen itself up to date. The Servo engine is bundled with the app, so engine security fixes arrive only in new versions of Ferowen.
  • Ferowen does not update itself yet. Check browser.enzonic.com regularly and install new versions when they are released.
  • Download Ferowen only from browser.enzonic.com.