xpinstall.signature.required was set back to true, seems like complaining works well

It was enabled due that zen was still a toy project and we needed people to easily open the debugger for easier bug fixing. This was due because zen was not in a daily drivable state and didn't gain any sort of popularity yet As the dev says in the PR almost nobody was using the browser at that point. To be able to interact with the debugging server you would need to have a port open on your firewall and router. And you would need to manually start the dev server. The problem in the PR is it was not prompting the user when launching the debug server and user could turn on the debugger without touching about:config flags.

The second part is more questioning, though not exploitable without the user clicking 2 times on a security warnings. I just checked their github to see if there is an issue/pr on the subject and there is none. Might be worth making one.

Imo they are more privacy conscious than Firefox and most Chromium based browsers, and on par with Floorp/Waterfox with their provided defaults.

If someone wants a good looking browser with vertical tab, while not having to debug privacy settings breaking site or having to write custom css to have the UI they like. Zen is my recommendation.

The only telemetry they leave is the ones that provide features to their users. For example, they need to ping mozilla for addons update, firefox sync, update the tracker block list, …

Although I agree with you that the privacy part of Zen the most beautiful, productive, and privacy-focused browser out there is clickbaity.

It’s not a backdoor, it just enabled Firefox’s remote debugging tool by default, which is necessary if you want to modify the chrome of the browser on your own computer.

At the time it was in one of its first alpha, sure it was naive to ship a browser with it enabled because it was convenient for development, but it was fixed 1 week after the issue was raised, and has been for months.

They use the release candidate to test upcoming Firefox releases and see if it breaks anything, to be able to ship the update on the same day as FF (just like the majority of other forks do). None of the patches they make require extra telemetry except for their “mod” system. Most of the criticism Zen gets about “security” applies to every browser except librewolf and tor. Zen is as secure as firefox is.

All this is coming from someone who doesn’t use Zen, as my workflow is constantly broken by their UI changes and bugs (which is the main problem with the browser).