obsidian-vault/work/wiki/apple-browsers/privacy-security.md

source, confidence, namespace, last_synced, alwaysApply

source	confidence	namespace	last_synced	alwaysApply
~/DuckDuckGo/apple-browsers.git/main/.cursor/rules/privacy-security.mdc	0.9	work	2026-04-28	true

Privacy & Security Guidelines

Core Principles

Privacy by Design

• Never collect or transmit user data without explicit consent
• All features must have privacy implications documented
• Default to the most private option
• Implement data minimization - only collect what's absolutely necessary

Secure Storage

Example: See secure-storage.swift

Data Handling

User Data Classification

1. Sensitive Data: Passwords, credentials, personal information

   • Must use Keychain or encrypted storage
   • Never log or transmit in plain text
   • Clear on app logout/uninstall

2. Private Data: Browsing history, bookmarks, settings

   • Store locally only
   • Implement proper data clearing
   • Respect fireproofing settings

3. Anonymous Data: Crash reports, usage statistics

   • Only collect with user consent
   • Strip all identifying information
   • Use differential privacy where applicable

Network Security

Example: See network-security.swift

Content Blocking

Tracker Protection

Example: See tracker-protection.swift

Cookie Management

Example: See cookie-management.swift

Authentication & Authorization

Biometric Authentication

Example: See biometric-authentication.swift

Credential Management

Example: See credential-management.swift

Error Handling

Secure Error Messages

Example: See secure-error-messages.swift

Code Security

Input Validation

Example: See input-validation.swift

Secure Defaults

Example: See secure-defaults.swift

Testing Security

Security Test Cases

Example: See security-test-cases.swift

Review Checklist

Before committing code, ensure:

• No hardcoded secrets or API keys
• All user data is properly classified and protected
• Network requests use HTTPS
• Input validation is implemented
• Error messages don't leak sensitive information
• Logging doesn't include PII
• Data clearing mechanisms are tested
• Privacy impact has been assessed