Limits of the browser data
- MDN Browser Compatibility Data (BCD) is maintained compatibility data and can contain corrections or incomplete statements.
- A support statement does not prove complete specification conformance or absence of defects.
- The catalogue covers nine desktop and mobile browser families, not every browser, operating system version, vendor shell, or embedded runtime.
- Mobile-family data may be mirrored from a related engine upstream and does not prove identical behaviour on every device.
- Web Platform Baseline from the WebDX community is adoption context, not deployment or configuration assurance.
- Web Platform Tests (WPT) mappings identify relevant conformance tests, but the registry does not ingest or simplify live pass rates.
- A passing conformance test does not establish correct application configuration, complete control coverage, or absence of browser defects.
- Lower-level BCD paths can change and require deliberate catalogue review.
Limits of the calculations
- Version comparison covers the numeric browser release forms used by the selected paths.
- Imprecise and unparseable support versions remain unknown or qualified.
- A multi-path mapping reflects the project-authored definition of a deployable control.
- Unsupported mappings are shown rather than approximated from a related feature.
Limits of the security checks
- No website is scanned and no runtime behaviour is observed.
- The optional assessment sees only supplied evidence. A bundle can bind assessed surfaces to an opaque inventory, make excluded entries explicit, reveal variation among included surfaces, and apply per-surface requirements. Independent policy can pin the inventory fingerprint, source kind, freshness, completeness, and exclusion count. ControlCurrent cannot discover omitted routes, redirects, status codes, cached responses, user states, or environments.
- Content Security Policy (CSP) can be correlated with supplied inline markup and bounded local resource bytes can be checked against Subresource Integrity (SRI) metadata. Nothing is fetched, and no result establishes remote resource identity, complete correctness, rollout safety, or effective browser enforcement.
- Fetch Metadata and Web Authentication (WebAuthn) inputs describe reduced configuration evidence; the tool does not test server enforcement, authenticator behaviour, or ceremony outcomes.
- Application, environment, revision, build, producer, and capture-time fields are fingerprinted assertions. An optional command-line gate can authenticate a matching signed statement from one exact Sigstore certificate identity, but it cannot prove that the producer's collection was complete or truthful.
- Fallback controls remain necessary for unsupported browsers and defence in depth.
- No result should be treated as legal, compliance, or certification advice.
How far each part of the tool can go
This table explains which jobs ControlCurrent handles well and where people or other security tools are still needed. These labels are not security scores or certification levels.
| What you are trying to do | How useful it is | What the result means |
|---|---|---|
| Plan browser support | Strong | Uses specific published browser records and keeps known limitations visible for the versions you choose. |
| Set an engineering policy | Strong, with limits | Produces repeatable browser minimums, records exceptions, and shows its data sources. People must still decide whether the policy suits the organisation. |
| Check supplied configuration evidence | Useful but incomplete | Checks a limited amount of supplied header, page, resource, request, and passkey information without visiting or running the website. |
| Detect a changed report and confirm its signer | Strong for that narrow job | Fingerprints detect report changes and an optional signature check can confirm the approved signer. Neither proves that the original information was true. |
| Prove that every page was checked | Depends on your input | You supply the list of pages and environments. ControlCurrent cannot independently discover anything that was left out. |
| Test live browser and server behaviour | Not provided | ControlCurrent does not exercise browser enforcement, server permissions, passkey devices, or remote resources. |
| Certify a production website | Not provided | No result is a vulnerability assessment, compliance decision, penetration test, or security certification. |