ControlCurrent glossary

Looking for a particular term? Use your browser's find command. The glossary contains no tracking, search service, or external request.

Browser baseline

The oldest version of each browser that a website promises to support. ControlCurrent checks features against these minimum versions, not the browser you happen to be using.

Browserslist

A common project configuration for describing supported browsers. ControlCurrent accepts only explicit minimum versions from a local .browserslistrc or package.json because relative queries such as “last two versions” can change over time.

Browser Compatibility Data (BCD)

The maintained MDN dataset that records when web features became available, were removed, or have known limitations in different browsers.

Browser security feature

A browser-enforced capability that can support a security goal, such as restricting scripts or protecting cookies. Availability does not prove that a website configured it correctly.

Content Security Policy (CSP)

Instructions sent by a website that restrict which content a browser may load or run. A strong policy can reduce content-injection risk, but it must be designed and tested for the application.

Continuous integration (CI)

An automated workflow that checks code or a deployment. ControlCurrent can optionally confirm that an approved CI workflow signed an unchanged evidence report.

Evidence

Information supplied for review, such as response headers, page markup, local resource files, request details, or reduced passkey settings. Evidence can support a conclusion only within its stated scope.

Fallback

A protection or safer operating approach kept in place when a browser feature is unavailable, limited, or not configured everywhere.

Fingerprint

A cryptographic summary used to tell whether a file, report, or page list has changed. It does not reveal the original contents or prove that those contents were complete.

Origin

The combination of a URL's scheme, host, and port. Browsers use origins to separate content and decide which cross-site actions are allowed.

Passkey and WebAuthn

WebAuthn is the browser standard used for passkeys and other public-key sign-in methods. ControlCurrent can review reduced settings, but it does not perform a sign-in ceremony or test an authenticator.

Policy as code

A machine-readable record of required security features, browser minimums, decision rules, and expiring exceptions. It makes an engineering decision repeatable without turning it into a security certification.

Response header

An instruction or piece of metadata that a web server sends with a response. Several browser security features are configured through response headers.

Sigstore

A signing system used to check that a particular identity signed an unchanged digital statement. A valid signature proves the signer and content match; it does not prove the statement is true.

Subresource Integrity (SRI)

A browser feature that checks a script or stylesheet against an expected cryptographic hash before using it. It is most useful for stable resources whose exact content is known.

Web Platform Baseline and WebDX

A shared way to describe whether a web feature is broadly available across major browsers. ControlCurrent uses it as adoption context, not as proof of a secure deployment.

Web Platform Tests (WPT)

Public conformance tests shared by browser projects. ControlCurrent links to reviewed tests as supporting evidence but does not turn their live results into a security score.