Addition of data for browsers' secure profiles

What type of issue is this?

Missing compatibility data

What information was incorrect, unhelpful, or incomplete?

Some browsers offer secure profiles that disable unsafe features:

• Safari offers Lockdown Mode
• the Tor Browser offers a security slider
• Microsoft Edge offers Enhanced Security (formerly known as Super Duper Secure Mode).

Documentation on which features aren't available in these modes is missing. This makes them very difficult to learn about, let alone target.

What browsers does this problem apply to, if applicable?

Chromium (Chrome, Edge 79+, Opera, Samsung Internet), Firefox, Safari

What did you expect to see?

Safari

Safari offers "Lockdown mode" which disables several features. Lockdown mode in Safari 16.4 does the following:

• Disable binary fonts in the CSS Font Loading API
• Disable Cache API
• Disable CacheStorage API
• Disable ServiceWorkers
• Disable SVG fonts
• Disable the WebLocks API
• Disable WebSpeech API
• Disable WebAssembly
• Disable JIT compilation

Lockdown mode in Safari 16.5 also disables the WebCodecs API. Lockdown mode in the upcoming Safari 17 does the following:

• Disables IndexedDB.
• Disables the File API and FileReader API.
• Disables support for the <embed> element.
• Disables the Web Speech (Speech Synthesis) API.
• Disables the WebLocks API.
• Disables support for experimental APIs.
• Supports select web fonts.

Tor Browser

The Tor Browser is based on Firefox ESR (though it lags several months behind new major releases). It offers a security slider that disables several features.

"Safer" mode disables:

• WebAssembly
• JIT-compilation for JavaScript and regex
• MathML
• Graphite font rendering
• SVG fonts
• JavaScript on unencrypted connections
• Auto-loading audio and video (they are click-to-play)

"Safest" mode includes the changes in "Safer", but also disables:

• SVG
• JavaScript
• Native lazy-loading

Microsoft Edge

Microsoft Edge's "enhanced" security mode (also known as "Super Duper Security Mode") disables Just-In-Time compilation (note that it now bundles a WebAssembly interpreter, allowing WebAssembly to run without JIT compilation on certain CPU architectures). It can be enabled across an organization via an enterprise policy. I'm not aware of any other changes yet, but I believe more will land with time.

Did you test this? If so, how?

Not applicable; this issue is requesting a new category of BCD documentation, not a single correction/addition.

Can you link to any release notes, bugs, pull requests, or MDN pages related to this?

The WebKit Blog covers updates to Lockdown Mode in Safari:

• WebKit Features in Safari 16.4
• WebKit Features in Safari 16.5
• News from WWDC23: WebKit Features in Safari 17 beta

Tor Browser official documentation and source code for its Security Levels module describe the changes it makes.

Microsoft Edge Enhanced Security documentation details how it disables JIT but still supports WebAssembly. Enhanced Security's introductory blog post also details how they added the "Drumbrake" WebAssembly interpreter.

Do you have anything more you want to share?

Current BCD data excludes at-risk users who depend on secure browsing profiles to stay safe, especially Lockdown Mode in Safari or the Tor Browser's "safer" and "safest" modes. Developers who need to build with security in mind should target these modes. Right now, documentation is scattered which makes this task very difficult. BCD is in a unique place to fix this.

BCD should highlight unsafe features that are only available in insecure modes, but are disabled in secure profiles.

MDN URL

No response

MDN metadata

No response

Start by reviewing the existing browser-compat-data conventions and the linked WebKit, Tor Browser, and Microsoft Edge documentation. Determine how a secure-profile category would be represented across affected feature records, then verify that Safari Lockdown Mode, Tor Safer/Safest, and Edge Enhanced Security are documented without overstating version coverage.