A browser is only as safe as its last update. This page says how Noah gets its updates, and who answers for them.
Status: before the first build
Noah has not shipped yet. What follows is the process the first release is being built to, written down now so you can hold us to it, and updated with a dated entry as each piece lands. Where something is still a decision rather than a fact, it says so.
What we commit to
- Noah tracks Chromium's Extended Stable channel, the one Google keeps patched for the longest.
- Every Chromium security release is merged, built, signed and shipped as a Noah update within seven days; within seventy-two hours when Google reports a flaw being exploited in the wild.
- Each release note names the Chromium version it carries, so you can check for yourself.
- Noah sends no telemetry. Crash reports are opt-in. Your account holds your ticket and, once sync ships, your sidebar; never your passwords.
How a release is made
- Builds are made from a pinned, reviewed Chromium checkout and a small patch set under version control, so every release can be rebuilt from its sources.
- Mac builds are signed with an Apple Developer ID and notarised by Apple, so macOS verifies them before they run.
- Updates arrive through Sparkle, with a signed appcast; Noah refuses an update whose signature does not match.
- Signing keys are kept off the build machine and backed up offline.
- Before every release, a checklist is run: extensions and password managers (1Password, Bitwarden, iCloud Passwords), site sign-ins, and a set of security checks that the hardening Chromium ships with is still switched on.
Who answers for it
Security and releases are owned by the people building Noah, not by a future hire. The weekly rebase onto Chromium comes before feature work, every week, from the first build on.
Still to decide
- Safe Browsing: whether to use Google's service, a privacy-preserving variant, or neither, and what the default is. Decided and documented before the beta.
- Widevine (DRM for streaming sites): subject to Google's licence; enquiry sent.
- A built-in ad blocker: after the beta.
Reporting a problem
Write to hello@noahbrowser.com with "Security" in the subject. You will hear back within two working days. There is no bounty programme yet; we credit reporters who want to be credited, and we do not take action against good-faith research. A security.txt is published with the first build.