v0.1.12813 Aug 2026·Networking, Privacy & Shields, Memory & reading

HSTS: sites that demand https are never reached over plaintext, not even once

A site can tell a browser it must only ever be reached over https (HTTP Strict Transport Security). Floati parsed that header for compression but never acted on it, so it would still make the one plaintext request an attacker on your network needs to strip TLS or plant a redirect. Now the engine enforces HSTS. When a site sends Strict-Transport-Security over a secure connection, the engine remembers it and, from then on, upgrades every http request to that host to https BEFORE any socket is opened - so the insecure request simply never goes out. It honours max-age (including max-age=0 to un-pin), includeSubDomains, and ignores the header when it arrives over plaintext (per the spec, so an attacker cannot forge or clear a pin). It also ships a small curated preload subset of the highest- traffic always-https hosts, so those are upgraded even on the very first visit of a fresh session, closing the trust-on-first-use gap for them. This closes the scorecard's note that HSTS was parsed but not enforced. Security moves 39 to 40; overall holds at 52.

Parity with the reference browser

74overall, as of v0.1.343

Web APIs / DOM surface42

Security architecture66

GPU / graphics acceleration68

DevTools / extensions72

Networking85

Media85

Accessibility85

Real-world site compatibility99

HTML parsing100

CSS parsing + selectors100

Layout: block / flex / grid / tables / writing-modes100

Paint + visual100

JavaScript language100

JavaScript performance (JIT)100

HTML parsing100

What changed 3 changes

Privacy & Shields	A from-scratch HSTS store (core-security/hsts.rs): parses Strict-Transport-Security (max-age, includeSubDomains, preload; max-age=0 un-pins), matches superdomains for includeSubDomains, expires pins by an injected clock, and upgrades http/ws to https/wss (collapsing a default :80 to the https default). A curated preload subset upgrades the highest-traffic always-https hosts with no prior visit. 9 unit tests.
Networking	Wired into the network layer (core-net/hsts.rs + the two request hops): every request upgrades a pinned host to https before a socket is opened, and every secure response records its Strict-Transport-Security header, so both navigations and subresources are covered at the one choke point all fetches pass through.
Memory & reading	Honest scope: the dynamic store is session-scoped in memory plus the baked-in preload subset (persisting dynamic pins across restarts is a clean follow-up); the preload set is a deliberate curated subset, not the full multi-megabyte list. Whole conformance suite unchanged (6375/6375).