Hi, I make Akari, a Chromium-based browser for macOS (Developer ID, notarized). On 2026-09-23 I requested the Web Browser Public Key Credential entitlement (com.apple.developer.web-browser.public-key-credential) so people can use the passkeys saved in iCloud Keychain. Request ID A9LNZMTCS4. On 2026-10-12, Developer Support (case 102988458082) emailed to say the entitlement had been issued. It still hasn't shown up: Certificates, Identifiers & Profiles > io.0arch.akari > Capability Requests still shows "Web Browser Public Key Credential Requests" as Submitted, with no way to enable it. The App Store Connect API lists only In-App Purchase as a capability for the App ID. Developer ID provisioning profiles generated on 10-12 and 10-15 don't include the entitlement. I replied on the case with screenshots on 10-12 and again on 10-15, and submitted a follow-up on 10-18, but I haven't heard back. Phone support currently says it's unavailable. Two questions: Is there anything else I need to do for an approved entitlement to be applied to the App ID? My membership is an individual account. Is an individual account eligible for this entitlement, or does it need an organization account? Team ID: G9KB4QTS57 Bundle ID: io.0arch.akari Thanks, Joseph

Safari continues to display a "Fraudulent Website Warning" for openvan.camp despite the domain being clean across all major security databases for over a week. Chrome, Firefox, and all other browsers open the site without any warnings. Domain: openvan.camp Warning appeared: March 18, 2026 Warning type: Fraudulent Website Warning (red screen) Current security database status: Google Safe Browsing: ✅ Clean (transparencyreport.google.com) Google Search Console: ✅ No security issues Spamhaus DBL: ✅ Removed from blocklist Fortinet FortiGuard: ✅ Category "Travel" VirusTotal: ✅ 0/65 vendors URLVoid: ✅ 0/35 engines Steps taken: Removed the third-party ad network (Adsterra) that caused the original flag — March 18, 2026 Migrated hosting to Scaleway (AS12876, France), IP: 151.115.84.228 Configured SPF, DKIM, DMARC records Created functional abuse@ and postmaster@ role accounts Submitted review via websitereview.apple.com — no response after 5 days What we believe is happening: Apple's Safe Browsing database appears to have an independent entry for this domain that has not been updated despite all underlying security databases clearing the flag. Safari's warning persists even after deleting ~/Library/Safari/SafeBrowsing/ cache and re-downloading the database — which confirms this is not a local cache issue. Steps to reproduce: Open Safari on macOS or iOS Navigate to https://openvan.camp/ Safari displays "Fraudulent Website Warning" Open the same URL in Chrome — no warning Expected behavior: No warning should be shown. The domain is legitimate, clean, and verified. Has anyone experienced a similar issue? Is there any additional channel to escalate beyond websitereview.apple.com?

I develop products for VelikSoft Limited and have an active Apple Developer Program membership. Safari displays Fraudulent Website Warnings for four company-owned domains that we believe are false positives. Domains and IPv4 addresses checked on October 17, 2026: veliksoft.com - 77.110.106.89 tizigo.net - 77.110.106.89 vstranslate.net - 77.110.106.89 translatorphone.com - 94.228.163.126 The first three share a server. The newer translatorphone.com was placed on a different server and IP, but also received the warning shortly after launch. A shared IP alone therefore cannot explain all four warnings. The classification provider and trigger remain unknown. The latest site is an informational translator-device project website, with no EXE downloads. Its homepage serves HTTPS with HTTP 200; www redirects to the same domain. A limited check of homepage references and the primary application script found local assets and interface interactions, without an executable download or automatic redirect to the old server. This is not an exhaustive security audit. It identifies VelikSoft Limited and links to our company site. Chrome opens it normally on this Mac. Earlier checks of the older domains using Search Console and independent security services did not explain the Safari warnings. These historical checks are not current verdicts for the newer domain. We already submitted Website Review requests multiple times and Feedback Assistant report FB24448660. Apple Developer Support case 102967798534 records contact events on September 19, September 30 and October 1, 2026. As of October 17, we have no substantive explanation or resolution. Telephone support is not a usable option for us. Can an Apple engineer or a website owner who resolved a comparable issue advise: How can we identify whether the warning comes from Apple, Google Safe Browsing or another provider? Is there an owner-accessible diagnostic identifying the affected URL and reason? Which escalation path works when Website Review and an existing support case have not produced a substantive response? Can the existing case and FB report be routed for a manual review of all four domains? If you resolved this, what evidence and contact channel actually led to a review? Reproduction: open one of the affected HTTPS domains in Safari with Fraudulent Website Warning enabled; the red warning appears instead of the site. Safari 26 on macOS has been affected. I can provide exact current version details and further evidence through the support case if requested. I am seeking an investigation and correction of any mistaken classification, not instructions to disable protection or bypass warnings.

Hi everyone, I'm hoping someone can help with an issue I'm having with Apple's Web Content Restrictions. I manage a legitimate fitness and wellness website, but some iPhone/iPad users are unable to access it when they have: Settings → Screen Time → Content & Privacy Restrictions → App Store, Media, Web & Games → Web Content → Limit Adult Websites enabled. They receive: Website Not Allowed The website is a restricted website. I've been able to reproduce the exact same issue myself by enabling this setting on an iPhone. The important point is that the website is not adult content whatsoever. It is a normal fitness/wellness website providing workouts, fitness programmes, nutrition guidance and related content. There is no pornography, sexually explicit content or adult services. I've also tested blank pages and different URLs associated with the site, and the restriction still occurs. Everything works normally when the Web Content setting is changed to Unrestricted Access. I've contacted Apple Support and Apple Developer Support but haven't been able to get the issue in front of someone who can review the website's classification. Does anyone know how to request a review or reclassification of a website that appears to have been incorrectly flagged by Apple's Web Content Filter? I'm not trying to bypass Apple's parental controls. I simply want to understand how a legitimate fitness website can be reviewed and removed from whatever classification is causing it to be blocked under Limit Adult Websites. Any advice from anyone who has dealt with this before would be hugely appreciated.

This is a rare occurrence on our site, having only detected 4 instances of it over the past few weeks, where 10s of thousands of transactions have occurred successfully. We only call the following PaymentRequest API onClick from the <apple-pay-button>: async function startApplePay(merchantIdentifier, amount) { ... try { const request = new PaymentRequest([ applePayMethod ], paymentDetails); ... catch (e) { // cancel, just stay here if (e.name === "AbortError") { if (consoleLog) console.log("Payment canceled", e); logServer("INFO", "Payment canceled"); } else { handleError("Error caught: " + e.name + ", " + e.cause + ", " + e.message); } } Where the "handleError" else case is what gets triggered: Error caught: SecurityError, undefined, show() must be triggered by user activation. All 4 instances have been from iPads, but with that small of a sample size, we can't tell whether that's relevant or coincidence. Different iOS versions, but looks like same Safari version. Here are the 4 User Agents we've seen thus far: Mozilla/5.0 (iPad; CPU OS 18_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/352.0.715618234 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPad; CPU OS 17_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) GSA/352.0.715618234 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPad; CPU OS 18_3_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.6943.33 Mobile/15E148 Safari/604.1 Mozilla/5.0 (iPad; CPU OS 18_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/133.0.6943.33 Mobile/15E148 Safari/604.1

When using a web page to upload from the camera roll. During selection everything is ok but after confirming the selection, its still possible to change the selection and if media is in a processing or downloading state its not obvious to a user what is going on. This results to a confusing user experience. It doesn't seem like theres any signal back to the page in this state, its just a poor camera roll picker which doesn't block selection changes or show any progress that something is happening (i.e. localising or processing for upload). Same result on Chrome and Safari

When I login to an account on a subdomain of a main domain, I want to be able to store a separate password for the same login id on the main domain account. This doesn't seem possible in the current Safari implementation.eg: domain.com is the main domain and is the general information site.my.domain.com is the subdomain that hosts the customer support.I want different passwords on each for the same login ID... Can't I do this?--marcel

Issue Description My Mac originally had macOS 26.2, and I updated it to macOS 26.6. After using Safari normally for 2–3 days, Safari suddenly crashed. After the crash, when I open Safari again, it sometimes launches as a new/empty Safari instance instead of opening my existing Safari profile. My bookmarks, history, tabs, and other Safari profile data are not available in this new instance. While investigating the issue, I found a folder under my Mac's Library whose name appears to be my Mac's serial number/hardware identifier. This folder contains Safari-related files. I believe this serial-number-named folder may be related to the problem. My concern is that this folder may be causing Safari to create or open another Safari instance/profile after Safari crashes. If this folder is incorrectly created or recreated, it may explain why a new Safari instance appears and why my original Safari profile is not loaded. I have already contacted Apple Support and tried the following: Created and tested with a new macOS user Tested in Safe Mode Cleared Safari cache and cookies and checked Safari Library data Restarted the Mac multiple times Reinstalled macOS Completely erased the internal drive Performed a fresh macOS installation Updated macOS to the latest available version The issue still occurs even after completely erasing the drive and performing a clean macOS installation. I am also currently seeing two different Safari icons/appearances on my Mac: one appears to be the newer macOS 27 Safari icon, while another appears to be the older macOS 26 Safari icon. Request to Apple Please investigate the serial-number-named folder specifically and determine: Why this folder is created. Which macOS or Safari process creates it. What its purpose is. Whether it is related to Safari profiles, containers, application registration, or Safari instances. Whether this folder can cause Safari to launch as a new/empty instance after a crash. Why the folder or related Safari state can appear again even after a completely clean macOS installation. Why two different Safari icons/appearances are currently present. I believe identifying the source and purpose of this serial-number-named folder may help identify the root cause of the Safari issue. I do not want to delete or modify this folder without Apple's confirmation because it may be a system-managed folder. Please investigate this as a possible macOS/Safari system-level issue and escalate it to the Safari/macOS engineering team if necessary. I can provide the exact folder path, screenshots, Safari crash reports, system logs, and Terminal output showing the Safari application locations and related folders.

Hi, We are experiencing an issue where Safari displays a “Deceptive Website Warning” when accessing our legitimate website: https://burbleonline.co.za The domain is owned and operated by a legitimate business and has been in use for several years. The website is an online printing/e-commerce platform. We have investigated the issue and so far: The website uses a valid HTTPS certificate. The certificate is issued by Let’s Encrypt and is currently valid. The domain is not newly registered. The website is operational and does not intentionally host phishing or deceptive content. We have checked the site and have not identified any obvious malicious redirects or injected content. Current third-party reputation checks do not show a broad consensus that the domain is malicious. One security reputation provider, SOCRadar, currently appears to classify the domain as malicious, which may be contributing to the warning. The website also uses standard third-party services such as Google Analytics/Tag Manager and Tawk.to. We would appreciate any guidance on how Safari’s fraudulent/deceptive website classification can be reviewed or corrected. In particular: Is there a way to determine why Safari is currently classifying this domain as deceptive? Is there an Apple-specific process for requesting a review/false-positive correction? If the classification originates from a third-party Safe Browsing or threat-intelligence source, does Apple automatically refresh this classification after the source is corrected? Is there anything specific we should check on the website or infrastructure to ensure it complies with Safari’s security requirements? We would be happy to provide additional technical information, URLs, screenshots, or verification of domain ownership if required. Thank you.

Hi, Safari shows a “Deceptive Website” warning for https://mim-kulinariya.com/. It’s a simple café menu with prices and contact details. No login, payments, personal data collection forms or tracking scripts. It’s hosted on GitHub Pages with a valid Let’s Encrypt certificate. I submitted a review request through websitereview.apple.com but have received no response at all. The warning discourages customers from visiting our website. Could someone from Apple please help expedite the review or explain how to escalate this? If a specific page or resource triggered the warning, please let us know so we can address it promptly. Thank you.