HELMET WEB BROWSER FIREWALL

The Helmet Web Browser Firewall is the browser's built-in URL and content threat-defense system. It combines a hardened Safe Browsing gateway with curated open threat-intelligence feeds (URLHaus, HaGeZi, KADHosts, Anudeep). A Smart Detection master toggle plus per-feed switches govern active contributors; their scored verdicts feed the local SentinelCache and surface as block decisions through the Helmet Firewall toolbar and the ERR_BLOCKED interstitial. Everything runs inside the macOS App Sandbox — no listening sockets, all decisions client-side.

macOS-specific threats are our focus, as well as, Chromium-specific ones. Those kind of threats are taken very seriously by our TI enforcements techniques.

Every Helmet install ships with the hardened-Chromium core, the native macOS security stack and Safe Browsing enabled. Premium adds the rest of the Web Browser Firewall — the HelmetOn deferred-throttle engine, the user-tunable behavioural controls, the rules subsystem and the in-product VirusTotal layer.

Every protection feature, threshold and behaviour can be toggled or tuned from the Web Browser Firewall control panel; nothing is hidden behind command-line flags. The page is organised as a left-hand section index plus a scrolling content pane.

HelmetOn is Helmet's in-memory URL-check engine: every primary navigation is matched against the curated Threat Intel feeds on the request hot-path, with no out-of-process round-trip or network call to reach a verdict.

Its deferred throttle sums a weighted verdict from each contributor and blocks only once the aggregate crosses the user-configurable URL Blocking Threshold (default 5, range 1 – 30), so no single feed can block a benign URL on its own. Feeds refresh every 4 hours and write back into the verdict tables atomically.

Helmet is the first web browser to natively integrate VirusTotal as a built-in, in-product URL inspection layer. No extension, no companion app — every URL about to be rendered or downloaded can be inspected against VirusTotal's 70+ antivirus engines and URL/domain scanners directly from the browser's request hot-path.

• User-supplied API key. The Public API key is entered in the Web Browser Firewall settings, validated in-product, and persisted only locally (Keychain-encrypted). Helmet ships no shared key and proxies no queries.
• Per-request inspection. The URL is submitted from the Helmet process; the response is folded into the same verdict pipeline as HelmetOn feeds.
• Privacy-preserving submission. The entire query-string is stripped before submission — only scheme, host, port and path are sent. Never the query parameters; never credentials.
• Quota visibility. Today's calls vs. daily allowance and a per-endpoint breakdown are live in the toolbar popover and the Service Status panel.
• Single-click pause. Toggleable from the Helmet Navigation menu — pauses all VT calls without disabling the rest of the Firewall.
• Plan-aware. Public (free) is supported today; Premium is reserved for the professional product line.

Helmet keeps Chromium's multi-process model — a browser process, per-origin renderers, a GPU process, a network service and utility helpers, each in its own sandbox — but reproduces it end-to-end inside Apple's App Sandbox rather than Chromium's bundled sandbox_mac seatbelt profile.

Every release is built with a hardened security-and-privacy profile. The settings below are fixed at build time — they cannot be toggled at runtime by a user, policy or remote configuration.