the "--private-instance" mode of epiphany allows tracking a user across
different sessions, as can be shown using the evercookie website[1] by
invoking `epiphany -p`, going to the site, "create an evercookie",
closing the browser, invoking `epiphany -p` again, going there again and
clicking "rediscover cookies".

i would originally have reported this as security critical (earlier,
-p was described as "private browsing"), but now that epiphany has more
options (including --incognito-mode and --netbank-mode which i didn't
find documentation on), it is not clear any more whether -p is supposed
to invoke the expectancy of private browsing, so the updated bug issue
is:

for the --private-instance option, it is not clear from neither --help
nor man page, whether a user can expect be as unrelated to his other
browsing behavior as it can be expected from a web browser (eg. i'd
expect that there is no cross-session persistence, but wouldn't expect
tor-like anonymizaton).

[1] http://samy.pl/evercookie/