{ "name": "VPN provider facts", "description": "Leak statements, audits, owners, incidents, transparency and infrastructure claims for every VPN on the site, each with its source URL and the date it was read, plus a short verbatim quote where the source states something ('not stated' and 'none found' rows carry a note on what was searched instead).", "license": "https://creativecommons.org/licenses/by/4.0/", "rights": "MyIPScan's work under CC BY 4.0; quoted text belongs to its source.", "attribution": "MyIPScan (https://myipscan.net/vpn/); quoted evidence belongs to its source", "page": "https://myipscan.net/vpn/", "url": "https://myipscan.net/vpn/facts.json", "dateModified": "2026-10-21", "records": 472, "data": [ { "provider": "adguard-vpn", "provider_name": "AdGuard VPN", "page": "https://myipscan.net/vpn/adguard-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-13", "note": "No AdGuard VPN statement found in its release notes, blog or knowledge base.", "source_url": "https://adguard-vpn.com/en/versions/windows/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-13", "note": "No AdGuard VPN statement found in its release notes, blog or knowledge base.", "source_url": "https://adguard-vpn.com/en/versions/windows/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-13", "note": "No AdGuard VPN statement found in its release notes, blog or knowledge base.", "source_url": "https://adguard-vpn.com/en/versions/windows/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "DNS requests leaked", "platforms": [ "windows" ], "status": "fixed", "as_of": "2025-12-18", "fixed_in": "2.8", "note": "From AdGuard VPN's Windows release notes.", "evidence": "AdGuard VPN leaks DNS server requests #938", "source_url": "https://adguard-vpn.com/en/versions/windows/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "IP leak on network loss, and DNS leaks", "platforms": [ "linux" ], "status": "fixed", "as_of": "2024-10-10", "fixed_in": "1.1", "note": "The same Linux release also fixed DNS leaks while connected.", "evidence": "Temporary loss of network connection may lead to IP leak #32", "source_url": "https://adguard-vpn.com/en/versions/linux/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Kill Switch failed when DNS was lost", "platforms": [ "macos" ], "status": "fixed", "as_of": "2023-08-14", "fixed_in": "2.1.1", "note": "From AdGuard VPN's macOS release notes.", "evidence": "Kill Switch fails when DNS connection is lost #209", "source_url": "https://adguard-vpn.com/en/versions/mac/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "2.10.2", "released": "2026-10-13", "evidence": "Version 2.10.2 from October 13, 2026", "source_url": "https://adguard-vpn.com/en/versions/windows/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "2.10.1", "released": "2026-10-05", "evidence": "Version 2.10.1 from October 5, 2026", "source_url": "https://adguard-vpn.com/en/versions/mac/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "2.16.4", "released": "2026-09-03", "evidence": "Version 2.16.4 from September 3, 2026", "source_url": "https://adguard-vpn.com/en/versions/android/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "2.10.2", "released": "2026-08-01", "evidence": "Version 2.10.2 from August 1, 2026", "source_url": "https://adguard-vpn.com/en/versions/ios/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "1.7", "released": "2026-04-06", "evidence": "Version 1.7 from April 6, 2026", "source_url": "https://adguard-vpn.com/en/versions/linux/release.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "2024-2026", "note": "Requests are listed by country for each year without a total; AdGuard says it has no data to provide.", "evidence": "Last updated: October 2026", "source_url": "https://adguard-vpn.com/en/transparency.html", "source_type": "html", "requests": null, "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Adguard Software Limited", "country": "Cyprus", "note": "Registered in Limassol.", "evidence": "is a company registered in Limassol, Cyprus", "source_url": "https://adguard-vpn.com/en/privacy.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2025-03-25", "scope_type": "apps", "scope": "Android app, App Defense Alliance Mobile App Security Assessment (MASA) Level 2", "public": false, "evidence": "AdGuard VPN was reviewed by Leviathan Security Group", "source_url": "https://adguard-vpn.com/en/blog/adguard-vpn-independent-security-review-google-play-verification.html", "source_type": "blog", "verified_at": "2026-10-19" } ] }, { "provider": "airvpn", "provider_name": "AirVPN", "page": "https://myipscan.net/vpn/airvpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "incident", "title": "Windows DNS leak across physical adapters", "platforms": [ "windows" ], "status": "fixed", "as_of": "2026-09-01", "fixed_in": "Eddie 2.27.0", "note": "From the changelog of Eddie, AirVPN's client.", "evidence": "[fix] [windows] DNS leak: auto DNS covers all physical adapters", "source_url": "https://eddie.website/changelog/?software=client", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "Eddie 2.27.2", "released": "2026-09-14", "evidence": "Version 2.27.2 (Mon, 14 Sep 2026 08:16:32 +0000)", "source_url": "https://eddie.website/changelog/?software=client", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "AirVPN's desktop client Eddie is open source (GPLv3).", "repo_url": "https://github.com/AirVPN/Eddie", "evidence": "Open-Source, licensed under GPLv3, developed by AirVPN.", "source_url": "https://github.com/AirVPN/Eddie", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "amneziavpn", "provider_name": "AmneziaVPN", "page": "https://myipscan.net/vpn/amneziavpn-leak-test/", "facts": [ { "kind": "owner", "entity": "EUPHORIATECH LIMITED", "country": "Cyprus", "evidence": "EUPHORIATECH LIMITED Address: Akropoleos, 82 2nd floor 2012, Nicosia, Cyprus", "source_url": "https://amnezia.org/policy", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "7ASecurity", "published": "2023-01", "scope_type": "apps", "scope": "Whitebox review of the Windows, Linux, macOS and Android clients, carried out in May 2022", "public": true, "report_url": "https://7asecurity.com/reports/pentest-report-amneziavpn.pdf", "evidence": "7ASecurity reviewed our apps and server components", "source_url": "https://docs.amnezia.org/faq/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "7ASecurity", "published": "2024-12", "scope_type": "apps", "scope": "Review of the Android, iOS and desktop clients plus the AmneziaWG and XRay services", "public": true, "report_url": "https://7asecurity.com/reports/pentest-report-amneziavpn2.pdf", "evidence": "7ASecurity reviewed our apps and server components", "source_url": "https://docs.amnezia.org/faq/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "7ASecurity", "published": "2025-11", "scope_type": "full", "scope": "Whitebox audit of apps, custom protocols, infrastructure and supply chain, December 2024 to January 2025", "findings": { "critical": 2, "high": 1 }, "public": true, "report_url": "https://7asecurity.com/reports/pentest-report-amneziavpn3-RC1.1.pdf", "evidence": "7ASecurity reviewed our apps and server components", "source_url": "https://docs.amnezia.org/faq/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Amnezia says nothing is written to Premium server disks and everything is wiped on reboot.", "evidence": "nothing is written to disk and everything is wiped on reboot", "source_url": "https://amnezia.org/premium", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The desktop and mobile client is published on GitHub (GPL-3.0).", "repo_url": "https://github.com/amnezia-vpn/amnezia-client", "evidence": "Amnezia is an open-source VPN client", "source_url": "https://github.com/amnezia-vpn/amnezia-client", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "astrill", "provider_name": "Astrill", "page": "https://myipscan.net/vpn/astrill-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No Astrill statement found on its site, blog or app changelog.", "source_url": "https://www.astrill.com/downloads", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No Astrill statement found on its site, blog or app changelog.", "source_url": "https://www.astrill.com/downloads", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Veloxee Corp. (brand: Astrill)", "country": "Liechtenstein", "note": "The privacy notice names Veloxee Corp., Staedtle 36, 9460 Vaduz, as the controller. About-us says Astrill was founded in 2009 and calls it a registered Liechtenstein company. The terms of service apply Liechtenstein law.", "evidence": "is a brand by Veloxee Corp., with registered seat at Staedtle 36, 9460 Vaduz", "source_url": "https://www.astrill.com/privacy-policy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "No published independent audit found on astrill.com. Pages checked: the privacy notice (its 'No-logs policy' section 2.5 says Astrill keeps the last 20 connection records per account: time, duration, country, device type, app version), about-us, what-makes-astrill-special, the bug-bounty page and a blog search for 'audit'. The only external review mechanism is a discretionary bug bounty. It covers the website, member zone, server-side API and VPN infrastructure. The VPN apps are out of scope.", "source_url": "https://www.astrill.com/privacy-policy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "note": "Astrill documents a kill switch, plus an 'App Guard' on Windows that blocks only selected apps. No statement on TunnelVision or TunnelCrack found: an astrill.com/blog search for 'tunnelvision' returned no posts. Astrill is not in the TunnelCrack paper's results table.", "source_url": "https://www.astrill.com/features/kill-switch", "source_type": "html", "verified_at": "2026-10-21", "as_of": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Not claimed. The servers page FAQ only explains what RAM-only servers are and never says Astrill's servers are RAM-only. Elsewhere Astrill describes physical bare-metal servers ('Our VPN servers use powerful bare-metal hardware').", "evidence": "RAM-only servers do not store data on physical storage drives", "source_url": "https://www.astrill.com/network/vpn-servers", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "open_source_clients", "detail": "No open-source claim found. Astrill says it develops all its software in house, including its own OpenWeb and StealthVPN protocols.", "evidence": "We develop all our software in house.", "source_url": "https://www.astrill.com/what-makes-astrill-special", "source_type": "html", "verified_at": "2026-10-21" } ] }, { "provider": "avast-secureline", "provider_name": "Avast SecureLine VPN", "page": "https://myipscan.net/vpn/avast-secureline-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "incident", "title": "Windows DNS leak through multi-homed name resolution", "platforms": [ "windows" ], "status": "mitigated", "as_of": "2026-10-07", "fixed_in": "Avast Antivirus installed, or a Windows policy setting", "note": "Avast says its antivirus blocks the leak on IPv4 only; without it, a Windows policy setting has to be changed.", "evidence": "Avast Antivirus actively prevents DNS leaks on IPv4", "source_url": "https://support.avast.com/en-us/article/Prevent-SecureLine-VPN-DNS-leak/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "incident", "date": "2019-10-21", "type": "breach", "summary": "Avast disclosed that attackers used stolen credentials and a temporary profile on its internal corporate VPN to enter its network from May 2019, apparently aiming at CCleaner builds. SecureLine was not involved.", "provider_response": "Avast kept the profile open to monitor the attacker and halted CCleaner releases on 25 Sept 2019. It pushed a re-signed clean CCleaner update on 15 Oct 2019 and revoked the old certificate. It then closed the VPN profile and reset all internal credentials.", "evidence": "we believed that CCleaner was the likely target of a supply chain attack", "source_url": "https://blog.avast.com/ccleaner-fights-off-cyberespionage-attempt-abiss", "source_type": "blog", "verified_at": "2026-10-21" } ] }, { "provider": "avira-phantom-vpn", "provider_name": "Avira Phantom VPN", "page": "https://myipscan.net/vpn/avira-phantom-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Avira Holding GmbH & Co. KG", "note": "Named as the seller of the iOS app on the App Store.", "evidence": "Avira Holding GmbH & Co. KG", "source_url": "https://itunes.apple.com/lookup?id=1112484006&country=us", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "status": "none_found", "note": "Avira's help-centre articles on data, tracking and ports name no independent audit of Phantom VPN.", "source_url": "https://support.avira.com/hc/en-us/articles/360000299553-What-if-anything-do-you-track", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "betternet", "provider_name": "Betternet", "page": "https://myipscan.net/vpn/betternet-leak-test/", "facts": [ { "kind": "owner", "entity": "Betternet LLC", "country": "United States", "parent": "Point Wild (formerly Pango Group; merged with Total Security, announced 12 Dec 2024)", "note": "The terms of service give Betternet LLC's offices as 250 Northern Ave, 3rd Floor, Boston, MA 02210. They also say the 'Betternet' trademark belongs to its affiliate Anchorfree, LLC. Pango's about page describes Pango Group as backed by Aura's investors (WndrCo, Warburg Pincus, General Catalyst).", "evidence": "Betternet is provided by Betternet LLC, a division of the Pango Group", "source_url": "https://legal.betternet.co/documents/privacy_policy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "auditor": "Aon", "published": "2023-08-25", "scope_type": "no-logs", "scope": "Betternet's client and server side, free and paid, against its logging claims: node and cached logs from Aon's own browsing on a development VPN node, client analysis. Safeguards out of scope. 25 Aug 2023.", "public": true, "report_url": "https://www.betternet.co/wp-content/uploads/2024/07/Pango-Betternet-VPN-Privacy-Policy-Review-Summary-Report.pdf", "evidence": "Aon can reasonably conclude that Pango Group has fairly represented", "source_url": "https://www.betternet.co/wp-content/uploads/2024/07/Pango-Betternet-VPN-Privacy-Policy-Review-Summary-Report.pdf", "source_type": "pdf", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "note": "Betternet documents a kill switch and always-on auto-connect. No statement on TunnelVision found.", "source_url": "https://www.betternet.co/security-audit/", "source_type": "html", "verified_at": "2026-10-21", "as_of": "2026-10-21" }, { "kind": "transparency", "period": "2022", "note": "Aon's audit lists a '2022 Pango transparency Report' among the material it reviewed. No public Betternet or Pango transparency report or warrant canary was found on betternet.co, legal.betternet.co, pango.co/legal or the Pango VPN Products Privacy Notice. Request counts are therefore unknown.", "evidence": "including the review of a 2022 law enforcement transparency report", "source_url": "https://www.betternet.co/wp-content/uploads/2024/07/Pango-Betternet-VPN-Privacy-Policy-Review-Summary-Report.pdf", "source_type": "pdf", "verified_at": "2026-10-21" } ] }, { "provider": "bitdefender-vpn", "provider_name": "Bitdefender VPN", "page": "https://myipscan.net/vpn/bitdefender-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "android" ], "status": "not_affected", "as_of": "2024-05-24", "note": "Bitdefender says Windows and Android stay protected even with the Kill-Switch off.", "evidence": "If the Kill-Switch is disabled, then Windows and Android devices are still immune.", "source_url": "https://www.bitdefender.com/consumer/support/answer/102840/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2024-05-24", "fixed_in": "the Internet Kill-Switch, kept on", "note": "Apple's limits rule out a full fix; Bitdefender says the Kill-Switch must stay on, and with it off iOS is exposed.", "evidence": "on macOS and iOS it is imperative that the Kill-Switch remain active at all times", "source_url": "https://www.bitdefender.com/consumer/support/answer/102840/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Bitdefender's VPN support topic lists a TunnelVision article only.", "source_url": "https://www.bitdefender.com/consumer/support/topic/1557/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Bitdefender's VPN support topic lists a TunnelVision article only.", "source_url": "https://www.bitdefender.com/consumer/support/topic/1557/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Aon", "published": "2023-01-25", "scope_type": "infrastructure", "scope": "Privacy assessment of the VPN platform of Pango, Bitdefender's infrastructure partner at the time; Bitdefender's privacy policy now names a different processor.", "public": false, "evidence": "In November 2022, the Pango Group engaged the security firm Aon Cyber Solutions", "source_url": "https://www.bitdefender.com/en-us/company/VPN-Audit-Pango-2023", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Bitdefender S.R.L.", "country": "Romania", "note": "Headquartered in Bucharest.", "evidence": "may send some personal information to its main company - BITDEFENDER S.R.L, in Romania.", "source_url": "https://www.bitdefender.com/en-us/site/view/legal-privacy-policy-for-home-users-solutions", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "brave-vpn", "provider_name": "Brave VPN", "page": "https://myipscan.net/vpn/brave-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No Brave statement found in its release notes, site or public issue tracker.", "source_url": "https://brave.com/latest/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No Brave statement found in its release notes, site or public issue tracker.", "source_url": "https://brave.com/latest/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No Brave statement found in its release notes, site or public issue tracker.", "source_url": "https://brave.com/latest/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2024-03-19", "scope_type": "backend", "scope": "White-box test of the Guardian app backend APIs, February 2024, commissioned by DNSFilter.", "findings": { "critical": 0, "high": 1, "medium": 8, "low": 10 }, "public": true, "report_url": "https://www.assured.se/publications/assured-dnsfilter-guardian-app-api-penetration-test-verification-report-20240319.pdf", "evidence": "The initial software security audit occurred in February 2024", "source_url": "https://brave.com/firewall-vpn/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2024-07-08", "scope_type": "infrastructure", "scope": "Guardian VPN relays and API servers, including logging, March to April 2024.", "findings": { "critical": 0, "high": 0, "medium": 6, "low": 11 }, "public": true, "report_url": "https://www.assured.se/publications/assured-dnsfilter-guardian-infrastructure-audit-verification-report-20240708.pdf", "evidence": "the initial infrastructure security audit occurred in April 2024", "source_url": "https://brave.com/firewall-vpn/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Brave Software, Inc.", "country": "United States", "note": "Sells the VPN; the network is run by Guardian, according to the audit reports.", "evidence": "SERVICES OFFERED BY BRAVE SOFTWARE, INC.", "source_url": "https://brave.com/terms-of-use/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "infra_audit", "detail": "Brave says its no-logs claims were checked by a software audit and an infrastructure audit of the service run by Guardian.", "evidence": "independently verified through a software security audit and an infrastructure security audit", "source_url": "https://brave.com/firewall-vpn/", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "cloudflare-warp", "provider_name": "Cloudflare WARP", "page": "https://myipscan.net/vpn/cloudflare-warp-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No TunnelCrack entry in Cloudflare's published advisories or WARP changelog.", "source_url": "https://github.com/cloudflare/advisories/security/advisories", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No TunnelCrack entry in Cloudflare's published advisories or WARP changelog.", "source_url": "https://github.com/cloudflare/advisories/security/advisories", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2023-2754: Windows DNS sent to a local IPv6 address", "platforms": [ "windows" ], "status": "fixed", "as_of": "2023-08-03", "fixed_in": "2023.7.160.0", "note": "On IPv6 networks the client set DNS servers that a rogue host on the same Wi-Fi could answer, so it could see DNS queries.", "evidence": "Version 2023.7.160.0 for WARP Client (Windows)", "source_url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-mv6g-7577-vq4w", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Cloudflare, Inc.", "country": "United States", "note": "Named as the operator in the 1.1.1.1 app terms.", "evidence": "This Application is operated by Cloudflare, Inc., located at 101 Townsend St.", "source_url": "https://www.cloudflare.com/application/terms/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "BoringTun, Cloudflare's WireGuard implementation used in the WARP mobile apps, is open source.", "repo_url": "https://github.com/cloudflare/boringtun", "evidence": "BoringTun is successfully deployed on millions of iOS and Android consumer devices", "source_url": "https://github.com/cloudflare/boringtun", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "cyberghost", "provider_name": "CyberGhost", "page": "https://myipscan.net/vpn/cyberghost-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-12", "note": "Nothing on CyberGhost's own site; only press quotes reported by third parties.", "source_url": "https://support.cyberghostvpn.com/hc/en-us/articles/9912617679644-What-Is-CyberGhost-VPN-Leak-Protection", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-12", "note": "No statement found in CyberGhost's support centre.", "source_url": "https://support.cyberghostvpn.com/hc/en-us/articles/9912617679644-What-Is-CyberGhost-VPN-Leak-Protection", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-12", "note": "No statement found in CyberGhost's support centre.", "source_url": "https://support.cyberghostvpn.com/hc/en-us/articles/9912617679644-What-Is-CyberGhost-VPN-Leak-Protection", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2025-12-08", "scope_type": "no-logs", "scope": "Deloitte Audit Romania, ISAE 3000 limited assurance: server network, configuration, change management, incident response and dedicated-IP tokens. Third review.", "public": true, "report_url": "https://download.cyberghostvpn.com/press/documents/CON-003_CG_Report_ISAE_3000_(signed).pdf", "evidence": "This year, we completed our third independent audit by Deloitte Audit Romania", "source_url": "https://www.cyberghostvpn.com/privacyhub/privacy-audit-2025/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2022-09-22", "scope_type": "no-logs", "scope": "ISAE 3000 review of whether the privacy policy matches the server configuration; the report is available from Deloitte on request.", "public": false, "evidence": "CyberGhost VPN underwent an independent audit performed by Deloitte", "source_url": "https://www.cyberghostvpn.com/privacyhub/privacy-audit/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Jan-Jun 2026", "requests": 9, "note": "Police requests in the first half of 2026, alongside DMCA complaints; published quarterly.", "evidence": "Reflects the first six months of 2026 only.", "source_url": "https://www.cyberghostvpn.com/transparency-report", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "CyberGhost S.R.L.", "country": "Romania", "parent": "Kape Technologies PLC", "note": "Registered in Bucharest; the privacy policy names Kape as the ultimate holding company.", "evidence": "our ultimate holding company, KAPE TECHNOLOGIES PLC, and all its subsidiaries", "source_url": "https://www.cyberghostvpn.com/privacypolicy", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "CyberGhost says its VPN servers run on RAM only and are wiped on reboot.", "evidence": "CyberGhost VPN uses RAM-only servers that wipe all data every time they reboot", "source_url": "https://www.cyberghostvpn.com/features/no-logs-vpn", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "edge-secure-network", "provider_name": "Edge Secure Network", "page": "https://myipscan.net/vpn/edge-secure-network-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Microsoft statement found.", "source_url": "https://support.microsoft.com/en-us/topic/use-the-microsoft-edge-secure-network-to-protect-your-browsing-885472e2-7847-4d89-befb-c80d3dda6318", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Microsoft statement found.", "source_url": "https://support.microsoft.com/en-us/topic/use-the-microsoft-edge-secure-network-to-protect-your-browsing-885472e2-7847-4d89-befb-c80d3dda6318", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Microsoft Corporation", "country": "United States", "note": "Cloudflare runs the proxy as Microsoft's data subprocessor. Microsoft says the user's Microsoft account identity is never shared with Cloudflare. The current support page shows no retirement notice.", "evidence": "Microsoft Edge Secure Network is a service provided in partnership with Cloudflare.", "source_url": "https://support.microsoft.com/en-us/edge/use-the-microsoft-edge-secure-network-to-protect-your-browsing", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Microsoft's Secure Network support page and Cloudflare's Privacy Notice for Microsoft Edge describe data handling but cite no independent audit of the service. Microsoft keeps bandwidth data for the free 5 GB limit, and Cloudflare deletes proxy data within 25 hours.", "source_url": "https://support.microsoft.com/en-us/edge/use-the-microsoft-edge-secure-network-to-protect-your-browsing", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "No RAM-only claim. Cloudflare says it sees source IP, destination IP, ports, timestamp and an Edge token, deletes all of this proxy data within 25 hours, and does not log HTTP request data.", "evidence": "All Proxy Data will be deleted within 25 hours.", "source_url": "https://www.cloudflare.com/microsoft/microsoft-edge-privacy-notice/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "browser" ], "status": "not_stated", "note": "This is a browser-only proxy. In the recommended Optimized mode only unsecure traffic (open Wi-Fi, HTTP sites, invalid certificates) goes through the VPN, and streaming is excluded unless the user enables it. Microsoft makes no statement on TunnelVision or TunnelCrack, and the service is not in the TunnelCrack paper.", "source_url": "https://support.microsoft.com/en-us/edge/use-the-microsoft-edge-secure-network-to-protect-your-browsing", "source_type": "html", "verified_at": "2026-10-21", "as_of": "2026-10-21" }, { "kind": "transparency", "period": "2025-07 to 2025-12", "requests": null, "note": "Microsoft's report covers all consumer services, not Edge Secure Network alone: 5,587 US law-enforcement demands for consumer data in the period.", "evidence": "Microsoft received 5,587 legal demands for consumer data from law enforcement in the United States", "source_url": "https://www.microsoft.com/en-us/corporate-responsibility/reports/government-requests/customer-data", "source_type": "html", "verified_at": "2026-10-21" } ] }, { "provider": "expressvpn", "provider_name": "ExpressVPN", "page": "https://myipscan.net/vpn/expressvpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "linux" ], "status": "mitigated", "as_of": "2024-05-07", "fixed_in": "Network Lock, on by default", "note": "Only a risk if Network Lock, the kill switch, has been turned off; it is on by default.", "evidence": "kill switch on Mac, Windows, Linux, and routers, the potential for exposure is limited", "source_url": "https://www.expressvpn.com/blog/tunnelvision-expressvpns-statement-and-assessment-of-the-technique/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-07", "note": "Android does not support DHCP option 121, so the app cannot have been exposed.", "evidence": "On Android, you cannot have been exposed, regardless of your kill switch setting", "source_url": "https://www.expressvpn.com/blog/tunnelvision-expressvpns-statement-and-assessment-of-the-technique/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-07", "note": "Some exposure even with the kill switch on, because of an Apple limitation. ExpressVPN points to 4G or 5G instead of untrusted Wi-Fi.", "evidence": "But on iOS, there is some degree of vulnerability, even with our kill switch activated", "source_url": "https://www.expressvpn.com/blog/tunnelvision-expressvpns-statement-and-assessment-of-the-technique/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "macos", "linux", "android" ], "status": "not_affected", "as_of": "2023-09-06", "note": "ExpressVPN says it checked its apps and only the iOS app was affected.", "evidence": "verified it only impacted the ExpressVPN app for iOS", "source_url": "https://www.expressvpn.com/support/troubleshooting/expressvpns-response-to-tunnelcrack-vulnerability/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "ios" ], "status": "mitigated", "as_of": "2023-09-06", "fixed_in": "the iOS update of 17 Jul 2023", "note": "The update of 17 July 2023 warns you when the app detects an unsecured Wi-Fi network open to TunnelCrack and suggests turning off local network access.", "evidence": "deployed to all customers using the ExpressVPN app for iOS on July 17, 2023", "source_url": "https://www.expressvpn.com/support/troubleshooting/expressvpns-response-to-tunnelcrack-vulnerability/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2023-09-06", "note": "ExpressVPN's TunnelCrack page does not mention the ServerIP attack.", "source_url": "https://www.expressvpn.com/support/troubleshooting/expressvpns-response-to-tunnelcrack-vulnerability/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "RDP traffic outside the tunnel", "platforms": [ "windows" ], "status": "fixed", "as_of": "2025-07-18", "fixed_in": "12.101.0.45", "note": "Debug code in versions 12.97 to 12.101.0.2-beta let RDP and other port 3389 traffic bypass the tunnel. Reported 25 April 2025, fixed five days later.", "evidence": "We released a fix five days later in version 12.101.0.45", "source_url": "https://www.expressvpn.com/blog/expressvpn-rdp-leak-fixed/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "14.3.1", "released": "2026-09-22", "evidence": "2026 September 22 Windows 14.3.1", "source_url": "https://www.expressvpn.com/support/vpn-setup/release-notes/windows-app/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "14.3.1", "released": "2026-09-22", "evidence": "2026 September 22 version 14.3.1", "source_url": "https://www.expressvpn.com/support/vpn-setup/release-notes/mac-app/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "14.3.1", "released": "2026-09-22", "evidence": "2026 September 22 version 14.3.1", "source_url": "https://www.expressvpn.com/support/vpn-setup/release-notes/linux-app/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "12.82.0", "released": "2026-10-09", "evidence": "2026 October 9 version 12.82.0", "source_url": "https://www.expressvpn.com/support/vpn-setup/release-notes/android-app/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "12.76.0", "released": "2026-10-13", "evidence": "2026 October 13 version 12.76.0", "source_url": "https://www.expressvpn.com/support/vpn-setup/release-notes/ios-app/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "KPMG", "published": "2025-06", "scope_type": "privacy-policy", "scope": "ISAE 3000 assurance on the privacy and no-logs commitments.", "public": true, "report_url": "https://www.expressvpn.com/wp-ws-cache/uploads-expressvpn/2026/07/expressvpn_isae3000_2025-02-28.pdf", "evidence": "The third KPMG security audit of our privacy commitments (June 2025)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-11", "scope_type": "apps", "scope": "Aircove routers, second audit.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-aircove_2024.pdf", "evidence": "The second security audit by Cure53 of our Aircove routers (November 2024)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-10", "scope_type": "protocol", "scope": "Lightway after its rewrite in Rust, fourth audit.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-lightway_2024.pdf", "evidence": "The fourth audit of our VPN protocol Lightway by Cure53 (October 2024)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Praetorian", "published": "2024-09", "scope_type": "protocol", "scope": "Lightway, third audit; the public report is the retest.", "public": true, "report_url": "https://www.expressvpn.com/wp-ws-cache/uploads-expressvpn/2025/02/Praetorian-ExpressVPN-ExpressVPN-Lightway-Security-Assessment-Retest-Final-Version.pdf", "evidence": "The third audit of our VPN protocol Lightway by Praetorian (September 2024)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-06", "scope_type": "browser-extension", "scope": "The VPN browser extension, second audit.", "findings": { "medium": 1 }, "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-vpn-extension_2.pdf", "evidence": "A second audit by Cure53 of the ExpressVPN browser extension (June 2024)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Nettitude", "published": "2024-04-16", "scope_type": "apps", "scope": "Windows app, checking the fix for the split-tunnelling DNS leak.", "findings": { "medium": 1 }, "public": true, "report_url": "https://www.expressvpn.com/wp-ws-cache/uploads-expressvpn/2024/04/ExpressVPN-and-Nettitude-audit-report.pdf", "evidence": "Nettitude found just one issue, which it rated as medium severity.", "source_url": "https://www.expressvpn.com/research/audit-report-research-paper-windows-dns-leaks", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "KPMG", "published": "2023-12", "scope_type": "privacy-policy", "scope": "Assessment of the privacy policy claims.", "public": true, "report_url": "https://www.expressvpn.com/wp-ws-cache/uploads-expressvpn/2026/07/expressvpn_isae3000_2023-12-12.pdf", "evidence": "An audit by KPMG to assess our privacy policy claims (December 2023)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-11", "scope_type": "protocol", "scope": "Lightway, second audit.", "findings": { "critical": 0, "high": 0, "medium": 0, "low": 5, "info": 4 }, "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-lightway.pdf", "evidence": "The second audit of our VPN protocol Lightway by Cure53 (November 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-10", "scope_type": "browser-extension", "scope": "The VPN browser extension, first audit.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-vpn-extension.pdf", "evidence": "An audit by Cure53 of the ExpressVPN browser extension (October 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "KPMG", "published": "2022-09", "scope_type": "no-logs", "scope": "ISAE 3000 Type 1 assurance on the no-logs policy.", "public": false, "evidence": "An audit by KPMG of our no-logs policy (September 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-09", "scope_type": "apps", "scope": "iOS app.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-ios.pdf", "evidence": "A security audit by Cure53 of our app for iOS (September 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-08", "scope_type": "apps", "scope": "Linux app.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-linux.pdf", "evidence": "An audit by Cure53 of our Linux app (August 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-07", "scope_type": "apps", "scope": "macOS app.", "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-macos.pdf", "evidence": "An audit by Cure53 of our macOS app (July 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-05", "scope_type": "infrastructure", "scope": "White-box review of TrustedServer, the in-house VPN server software.", "findings": { "critical": 0, "high": 0 }, "public": true, "report_url": "https://cure53.de/pentest-report_expressvpn-trusted-server.pdf", "evidence": "A security audit by Cure53 of TrustedServer, our in-house VPN server technology (May 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "F-Secure", "published": "2022-04", "scope_type": "apps", "scope": "Windows app version 12.", "public": false, "evidence": "An audit by F-Secure of our Windows v12 app (April 2022)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2021-08", "scope_type": "protocol", "scope": "Lightway, first audit.", "public": true, "report_url": "https://cure53.de/pentest-report_lightway.pdf", "evidence": "A security audit by Cure53 of our VPN protocol Lightway (August 2021)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "PwC", "published": "2020-06", "scope_type": "backend", "scope": "PwC Switzerland on the build verification process.", "public": false, "evidence": "An audit by PwC Switzerland on our build verification process (June 2020)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "PwC", "published": "2019-06", "scope_type": "privacy-policy", "scope": "PwC Switzerland on privacy policy compliance and TrustedServer.", "public": false, "evidence": "PwC Switzerland of our privacy policy compliance and our in-house technology TrustedServer (June 2019)", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Jan-Jun 2026", "requests": 137, "note": "Government, law enforcement and civil requests; ExpressVPN says it had no logs to disclose.", "evidence": "Government, law enforcement, and civil requests 137", "source_url": "https://www.expressvpn.com/trust", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Express Technologies Ltd.", "country": "British Virgin Islands", "parent": "Kape Technologies PLC", "since": "2021", "note": "Kape lists the ExpressVPN acquisition as December 2021.", "evidence": "Express Technologies Ltd. operates under BVI jurisdiction, in accordance with BVI laws.", "source_url": "https://www.expressvpn.com/privacy-policy", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "incident", "date": "2021-09-16", "type": "other", "summary": "ExpressVPN's CIO was named in a US Department of Justice resolution over his earlier hacking work for a UAE company.", "provider_response": "ExpressVPN said it knew his background when hiring him and kept him in his role.", "evidence": "we do not condone Project Raven", "source_url": "https://www.expressvpn.com/blog/daniel-gericke-expressvpn/", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "ExpressVPN says its VPN servers run on RAM only and never write to hard drives.", "evidence": "VPN servers run on RAM only", "source_url": "https://www.expressvpn.com/features/trustedserver", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "f-secure-vpn", "provider_name": "F-Secure VPN", "page": "https://myipscan.net/vpn/f-secure-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos" ], "status": "not_affected", "as_of": "2024-05-29", "note": "Answer on F-Secure's own community, written for the company: the OS firewall keeps traffic off attacker routes.", "evidence": "we utilize the operating system firewall to prevent traffic from leaking", "source_url": "https://community.f-secure.com/en/discussion/128177/should-consumer-users-of-total-and-f-secure-vpn-be-concerned-about-the-tunnel-attack-mentioned-below", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-29", "note": "Android does not implement DHCP option 121.", "evidence": "The Android operating system doesn't support the DHCP option 121 so it is not vulnerable.", "source_url": "https://community.f-secure.com/en/discussion/128177/should-consumer-users-of-total-and-f-secure-vpn-be-concerned-about-the-tunnel-attack-mentioned-below", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-29", "note": "The app relies on Apple's VPN stack; F-Secure says only Apple can fix it and that it reported the issue to Apple.", "evidence": "our VPN utilizes the operating system's own VPN implementation and is vulnerable to this issue.", "source_url": "https://community.f-secure.com/en/discussion/128177/should-consumer-users-of-total-and-f-secure-vpn-be-concerned-about-the-tunnel-attack-mentioned-below", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "fixed", "as_of": "2023-08-21", "fixed_in": "updates deployed in August 2023, versions not named", "note": "Announcement on F-Secure's community; it does not separate LocalNet from ServerIP and also advises turning the Kill Switch on.", "evidence": "We have deployed updates that fix the TunnelCrack VPN Leak issue.", "source_url": "https://community.f-secure.com/en/discussion/127007/important-announcement-regarding-tunnelcrack-vpn-leak", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "fixed", "as_of": "2023-08-21", "fixed_in": "updates deployed in August 2023, versions not named", "note": "Same announcement; no per-attack or per-platform detail.", "evidence": "We have deployed updates that fix the TunnelCrack VPN Leak issue.", "source_url": "https://community.f-secure.com/en/discussion/127007/important-announcement-regarding-tunnelcrack-vpn-leak", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "F-Secure Corporation", "country": "Finland", "note": "Helsinki address in the privacy notice.", "evidence": "F‑Secure Corporation", "source_url": "https://www.f-secure.com/en/legal/privacy/total", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "status": "none_found", "note": "The F-Secure VPN product page and consumer privacy policy name no independent audit.", "source_url": "https://www.f-secure.com/en/vpn", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "fastestvpn", "provider_name": "FastestVPN", "page": "https://myipscan.net/vpn/fastestvpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Fast Technology Limited (FastestVPN)", "country": "Cayman Islands", "note": "The legal name comes from the cover of the Altius IT audit report ('PRIVACY NO LOG AUDIT REPORT For Fast Technology Limited January 29, 2023', https://fastestvpn.com/pdfs/no-log%20audit_report.pdf). No fastestvpn.com HTML page names the entity. The privacy policy also says FastestVPN is based in the Cayman Islands.", "evidence": "FastestVPN is a Cayman Island based company", "source_url": "https://fastestvpn.com/about", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "auditor": "Altius IT", "published": "2023-01-29", "scope_type": "no-logs", "scope": "Server configurations and log files on a sample of servers, plus the mobile app, checked against the no-log statements from 15 Dec 2022 to 29 Jan 2023. Security safeguards were out of scope.", "public": true, "report_url": "https://fastestvpn.com/pdfs/no-log%20audit_report.pdf", "evidence": "On the dates of our review, Altius IT did not find any evidence", "source_url": "https://fastestvpn.com/pdfs/no-log%20audit_report.pdf", "source_type": "pdf", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "infra_audit", "detail": "Limited to log configuration: for the no-logs audit, Altius IT inspected a sample of FastestVPN servers and server log files. It was not a security audit of the infrastructure. No RAM-only server claim was found on the homepage, privacy policy or terms.", "evidence": "Inspected a target sample of FastestVPN servers", "source_url": "https://fastestvpn.com/pdfs/no-log%20audit_report.pdf", "source_type": "pdf", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "ios" ], "status": "not_stated", "note": "A Kill Switch is listed for the Windows and iOS apps. No TunnelVision or TunnelCrack statement found: a fastestvpn.com/blog search for 'tunnelvision' returned no posts. FastestVPN is not in the TunnelCrack paper's table.", "source_url": "https://fastestvpn.com/", "source_type": "html", "verified_at": "2026-10-21", "as_of": "2026-10-21" } ] }, { "provider": "hideme", "provider_name": "hide.me", "page": "https://myipscan.net/vpn/hideme-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "linux" ], "status": "mitigated", "as_of": "2024-06-04", "fixed_in": "the Kill Switch, on by default only on Linux", "note": "hide.me points to its kill switch, which limits traffic to its VPN servers.", "evidence": "kill switch that limits internet connectivity exclusively to our VPN servers", "source_url": "https://hide.me/en/blog/what-is-tunnelvision/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-06-04", "note": "A statement about Android itself rather than the hide.me app.", "evidence": "aren’t affected by TunnelVision as they don’t use DHCP Option 121", "source_url": "https://hide.me/en/blog/what-is-tunnelvision/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-06-04", "note": "A statement about iPhones and iPads in general; hide.me cites App Store limits on kill switches.", "evidence": "Portable Apple devices like iPhones and iPads are currently vulnerable to TunnelVision", "source_url": "https://hide.me/en/blog/what-is-tunnelvision/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-06-28", "note": "hide.me's post on VPN vulnerabilities does not mention TunnelCrack.", "source_url": "https://hide.me/en/blog/vpn-vulnerabilities/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-06-28", "note": "hide.me's post on VPN vulnerabilities does not mention TunnelCrack.", "source_url": "https://hide.me/en/blog/vpn-vulnerabilities/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "0.9.14", "released": "2026-09-07", "evidence": "v0.9.14", "source_url": "https://github.com/eventure/hide.client.linux/releases/tag/v0.9.14", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Securitum", "published": "2024-06-07", "scope_type": "no-logs", "scope": "VPN container image, configuration files, deployment process and staff interviews against the no-logs claim, as of March 2024.", "public": true, "report_url": "https://hide.me/downloads/Securitum_Hide.me_no-log-policy_20240607.pdf", "evidence": "Securitum, a respected European security firm, has once again confirmed that our no-logs policy", "source_url": "https://hide.me/en/about", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "2025", "requests": 9, "note": "Law enforcement requests in 2025, alongside abuse complaints and DMCA notices; hide.me says it handed over no data.", "evidence": "This report covers the period from January to December 2025", "source_url": "https://hide.me/downloads/hide.me-transparency-report-2025.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "eVenture Limited", "country": "Malaysia", "note": "Registered office in Labuan.", "evidence": "We are registered in Malaysia under registration number LL09685", "source_url": "https://hide.me/en/privacy", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "hide.me's Linux command-line client is open source (GPL-2.0).", "repo_url": "https://github.com/eventure/hide.client.linux", "evidence": "Hide.me CLI VPN client for Linux", "source_url": "https://github.com/eventure/hide.client.linux", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "hola", "provider_name": "Hola VPN", "page": "https://myipscan.net/vpn/hola-leak-test/", "facts": [ { "kind": "owner", "entity": "Hola VPN Ltd.", "country": "Israel", "note": "The same EULA applies Israeli law and gives a postal address of POB 8025, Natanya, Israel. The FAQ footer reads 'Copyright 2026 Hola VPN Ltd.' The privacy policy says free users 'may be a peer on the Bright Data network' and can opt out by becoming Premium users. Wikipedia names the founders as Ofer Vilenski and Derry Shribman, and says Hola sold a majority stake in Luminati (now Bright Data) to EMK Capital in August 2017. No parent company is stated by Hola.", "evidence": "BETWEEN YOU (AN INDIVIDUAL) AND Hola VPN Ltd.", "source_url": "https://hola.org/legal/sla", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "The Hola FAQ says its CSO's 'recent actions include internal and external security audits' and describes a vulnerability bounty ($50 base). It names no auditor and links no report. The privacy policy (hola.org/legal/privacy) and EULA (hola.org/legal/sla) mention no audit either.", "source_url": "https://hola.org/faq", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2015-05-28", "type": "other", "summary": "Hola was found to be selling its free users' bandwidth as exit nodes through its sister service Luminati. 8chan's founder said his site was attacked through the Hola network.", "provider_response": "Per Wikipedia, Hola changed its FAQ to say free users act as exit nodes for paid Luminati users. The current privacy policy says free users may be peers on the Bright Data network.", "evidence": "In late 2014, Hola had begun selling access to its userbase as", "source_url": "https://en.wikipedia.org/wiki/Hola_(VPN)", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2015-05-29", "type": "other", "summary": "Security researchers disclosed vulnerabilities in the Hola software that could let an attacker deliver malware to Hola users.", "provider_response": "Hola updated its software, but the researchers said some vulnerabilities remained as of 1 June 2015 (per Wikipedia).", "evidence": "Hola updated its software but some of the vulnerabilities remained", "source_url": "https://en.wikipedia.org/wiki/Hola_(VPN)", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2017-11-09", "type": "other", "summary": "CVE-2017-16757: Hola VPN 1.34 for Windows was installed with weak permissions (Everyone:F) under Program Files. A local user could gain privileges by planting a Trojan 7za.exe or hola.exe.", "evidence": "Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2017-16757", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "hotspot-shield", "provider_name": "Hotspot Shield", "page": "https://myipscan.net/vpn/hotspot-shield-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in Hotspot Shield's support centre or blog.", "source_url": "https://support.hotspotshield.com/en/windows-hotspot-shield/security-and-privacy/is-my-vpn-connection-secure-and-private", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in Hotspot Shield's support centre or blog.", "source_url": "https://support.hotspotshield.com/en/windows-hotspot-shield/security-and-privacy/is-my-vpn-connection-secure-and-private", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in Hotspot Shield's support centre or blog.", "source_url": "https://support.hotspotshield.com/en/windows-hotspot-shield/security-and-privacy/is-my-vpn-connection-secure-and-private", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Aon", "published": "2023-08-25", "scope_type": "no-logs", "scope": "Free and paid tiers, client and server side, against the privacy policy's logging claims; security controls and hosting excluded. Summary report only.", "public": false, "evidence": "Aon's assessment included both free and paid tiers of the VPN", "source_url": "https://www.hotspotshield.com/reports/Pango_HotSpot%20Shield_VPN_Privacy_Policy_Review_Summary_Report.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "2018", "requests": 56, "note": "The newest transparency report on the site covers 2018; it reports no user data produced.", "evidence": "Total User Data Requests in 2018", "source_url": "https://www.hotspotshield.com/reports/AnchorFree_Transparency_Report-2018.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Anchorfree, LLC", "country": "United States", "parent": "Pango Group", "note": "The terms name Anchorfree LLC in Boston or Pango GmbH, depending on where you buy.", "evidence": "Pango Group (including Anchorfree LLC) complies with the EU-U.S. Data Privacy Framework", "source_url": "https://legal.hotspotshield.com/documents/privacy_policy", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "infra_audit", "detail": "Hotspot Shield says it commissioned an independent security audit; the page does not state its scope.", "evidence": "We've recently commissioned an independent security audit for our Hotspot Shield VPN", "source_url": "https://www.hotspotshield.com/security-audit/", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "icloud-private-relay", "provider_name": "iCloud Private Relay", "page": "https://myipscan.net/vpn/icloud-private-relay-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Apple statement found in its security releases.", "source_url": "https://support.apple.com/en-us/100100", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Apple statement found in its security releases.", "source_url": "https://support.apple.com/en-us/100100", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Apple statement found in its security releases.", "source_url": "https://support.apple.com/en-us/100100", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2022-46716: Private Relay did not match settings", "platforms": [ "ios", "macos" ], "status": "fixed", "as_of": "2023-03-16", "fixed_in": "iOS 16.2, macOS Ventura 13.1", "note": "Private Relay could behave differently from what the system settings showed. Entry added to Apple's notes on 16 March 2023.", "evidence": "Private Relay functionality did not match system settings", "source_url": "https://support.apple.com/kb/HT213530", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2023-40385: DNS queries leaked in WebKit", "platforms": [ "ios", "macos", "browser" ], "status": "fixed", "as_of": "2023-12-22", "fixed_in": "iOS 17, macOS Sonoma 14, Safari 17", "note": "DNS queries could be seen with Private Relay turned on.", "evidence": "view leaked DNS queries with Private Relay turned on", "source_url": "https://support.apple.com/kb/HT213938", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2024-44246: Reading List revealed the IP address", "platforms": [ "ios", "macos", "browser" ], "status": "fixed", "as_of": "2024-12-11", "fixed_in": "iOS 18.2, macOS Sequoia 15.2, Safari 18.2", "note": "Adding a site to the Safari Reading List could bypass Private Relay.", "evidence": "adding a website to the Safari Reading List may reveal the originating IP address", "source_url": "https://support.apple.com/en-us/121837", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2025-43276: Private Relay off with several users logged in", "platforms": [ "macos" ], "status": "fixed", "as_of": "2025-07-29", "fixed_in": "macOS Sequoia 15.6", "note": "Private Relay could fail to switch on when more than one user was logged in.", "evidence": "iCloud Private Relay may not activate when more than one user is logged in", "source_url": "https://support.apple.com/en-us/124149", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2025-43376: DNS queries leaked in WebKit", "platforms": [ "ios", "macos", "browser" ], "status": "fixed", "as_of": "2025-11-03", "fixed_in": "iOS 26, macOS Tahoe 26, Safari 26", "note": "DNS queries could be seen with Private Relay turned on. Entry added 3 November 2025.", "evidence": "view leaked DNS queries with Private Relay turned on", "source_url": "https://support.apple.com/en-us/125108", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "CVE-2026-65355 and CVE-2026-65352: IP address disclosed", "platforms": [ "ios", "macos" ], "status": "fixed", "as_of": "2026-09-14", "fixed_in": "iOS 26.6.1, macOS Tahoe 26.6.2", "note": "Issues in Authentication Services and WebKit let a site learn the user's IP address with Private Relay on.", "evidence": "determine a user's IP address with Private Relay turned on", "source_url": "https://support.apple.com/en-us/148282", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Apple Inc.", "country": "United States", "note": "The contracting entity for iCloud+ in the US; other regions use local Apple companies.", "evidence": "Apple Inc., located at One Apple Park Way, Cupertino, California 95014", "source_url": "https://www.apple.com/legal/internet-services/icloud/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "status": "none_found", "note": "Apple's Private Relay support page describes the design but names no independent audit.", "source_url": "https://support.apple.com/en-us/102602", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "ipvanish", "provider_name": "IPVanish", "page": "https://myipscan.net/vpn/ipvanish-leak-test/", "facts": [ { "kind": "audit", "auditor": "Schellman", "published": "2025-04-10", "scope_type": "no-logs", "scope": "No-logs audit concluded on 21 February 2025: interviews, server configuration review and test traffic", "public": false, "evidence": "Schellman Compliance, LLC, to conduct an independent audit of our systems", "source_url": "https://www.ipvanish.com/blog/no-log-vpn-audit/", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2022-04-04", "scope_type": "no-logs", "scope": "No-logs audit: staff interviews, system configuration, server deployment and test traffic", "public": false, "evidence": "Leviathan Security Group conducted interviews with staff responsible for maintaining our VPN servers", "source_url": "https://www.ipvanish.com/blog/ipvanish-no-logs-vpn-audit-2022/", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "In progress: IPVanish says it uses RAM-only servers and plans to be fully RAM-only by 2027.", "evidence": "IPVanish uses RAM-only servers and is on track to be 100% RAM-only by 2027.", "source_url": "https://www.ipvanish.com/no-log-vpn-policy/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "owner", "entity": "IPVanish, a Ziff Davis company", "country": "United States", "parent": "Ziff Davis", "evidence": "IPVanish, a Ziff Davis company. All rights reserved.", "source_url": "https://www.ipvanish.com/tos/", "source_type": "html", "verified_at": "2026-10-20" } ] }, { "provider": "itop-vpn", "provider_name": "iTop VPN", "page": "https://myipscan.net/vpn/itop-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "iTop Inc.", "country": "Hong Kong SAR, China", "note": "Where iTop Inc. is incorporated is not stated. The country is taken from the Terms of Service, which choose the laws of the Hong Kong Special Administrative Region, and a Kowloon address in the /about page's HTML. The EULA says IP rights in the product belong to Orange View Limited d/b/a iTop and its subsidiaries; how iTop Inc. relates to it is not stated.", "evidence": "owned and operated by iTop Inc.", "source_url": "https://www.itopvpn.com/privacy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Checked the privacy policy (last updated June 14, 2022), which says 'We do not log your activity while you are utilizing the Services'. Also checked /about, /terms, /eula, /vpn-windows and /vpn-servers. They claim a no-log policy and RAM-only servers, but none names an auditor or links an audit report.", "source_url": "https://www.itopvpn.com/privacy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "iTop claims RAM-only servers that wipe all data on every reboot. No independent verification is published.", "evidence": "It uses RAM-only servers so every system reboot automatically wipes all data instantly", "source_url": "https://www.itopvpn.com/vpn-windows", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows" ], "status": "not_stated", "as_of": "2026-10-21", "note": "The Windows page claims a kill switch, WebRTC leak defense and IPv4/IPv6/DNS masking. No TunnelVision or TunnelCrack statement was found on iTop's site or in a web search.", "source_url": "https://www.itopvpn.com/vpn-windows", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2024-02-02", "type": "other", "summary": "CVE-2024-1195 (VDB-252685): local denial of service through the IOCTL handler of the ITopVpnCallbackProcess.sys driver in iTop VPN up to 4.0.0.1.", "provider_response": "Per the NVD record, the vendor was contacted early about the disclosure but did not respond in any way.", "evidence": "A vulnerability classified as critical was found in iTop VPN up to 4.0.0.1", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-1195", "source_type": "nvd", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2022-07-06", "type": "other", "summary": "CVE-2022-24141: in iTop VPN 3.2, iTopVPNmini.exe keeps trying to connect to a named pipe. A local attacker who opens a pipe with that name can impersonate another user's token, which is privilege escalation.", "evidence": "The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-24141", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "ivpn", "provider_name": "IVPN", "page": "https://myipscan.net/vpn/ivpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "linux" ], "status": "mitigated", "as_of": "2024-05-08", "fixed_in": "the IVPN Firewall, on by default", "note": "IVPN staff say users are exposed only if the firewall is off, LAN access is allowed, or custom exceptions are set.", "evidence": "With the default configuration, IVPN users are not affected by this vulnerability.", "source_url": "https://github.com/ivpn/desktop-app/issues/374", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-08", "note": "Stated by IVPN staff on its official repository.", "evidence": "IVPN Android app is not affected.", "source_url": "https://github.com/ivpn/desktop-app/issues/374", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-08", "note": "IVPN says its Block LAN traffic option does not mitigate it on iOS.", "evidence": "IVPN iOS app is potentially affected based on our assessment", "source_url": "https://github.com/ivpn/desktop-app/issues/374", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "router" ], "status": "mitigated", "as_of": "2026-10-18", "fixed_in": "setting classlessroute to 0 on OpenWrt, by hand", "undated": true, "note": "IVPN's router guide shows how to turn off option 121 routes; the user has to apply it.", "evidence": "this exploit can be mitigated by setting the classlessroute interface option to 0", "source_url": "https://www.ivpn.net/knowledgebase/routers/openwrt-tunnelvision-mitigation-cve-2024-3661/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "macos", "linux" ], "status": "fixed", "as_of": "2023-09-07", "fixed_in": "the desktop release after 3.11.14, version not named", "note": "The issue applied only with Allow LAN traffic switched on, which is off by default.", "evidence": "This issue is fixed in the latest version of IVPN for Desktop apps.", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "android" ], "status": "fixed", "as_of": "2023-09-07", "fixed_in": "the Android release after 2.10.0, version not named", "note": "The issue applied only with Bypass VPN for local networks switched on, which is off by default.", "evidence": "The app disables local network access when the local network is using public IP addresses.", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "ios" ], "status": "mitigated", "as_of": "2023-09-07", "fixed_in": "the Disable LAN traffic option", "note": "Vulnerable by default; the user has to switch the option on.", "evidence": "option that offers a fix for this issue when using OpenVPN and WireGuard protocols", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "windows", "macos", "linux" ], "status": "not_affected", "as_of": "2023-09-07", "note": "The apps reach servers by IP address and pin the API certificate.", "evidence": "IVPN desktop apps are not vulnerable to this type of attack", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "ios" ], "status": "not_affected", "as_of": "2023-09-07", "note": "IVPN states the iOS app is not vulnerable.", "evidence": "Our iOS application is not vulnerable to this type of attack.", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "android" ], "status": "fixed", "as_of": "2023-09-07", "fixed_in": "the Android release after 2.10.0, version not named", "note": "An OpenVPN fallback that looked servers up by hostname was removed.", "evidence": "We have removed the fallback logic to connect using DNS (hostname)", "source_url": "https://www.ivpn.net/blog/ivpn-tunnelcrack-vulnerability-assessment/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Windows DNS leak, firewall rules hardened", "platforms": [ "windows" ], "status": "fixed", "as_of": "2025-12-04", "fixed_in": "3.15.0", "note": "From IVPN's desktop changelog.", "evidence": "(Windows) Hardened firewall rules to prevent DNS leaks", "source_url": "https://raw.githubusercontent.com/ivpn/desktop-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "DNS leak during WireGuard key rotation", "platforms": [ "ios" ], "status": "fixed", "as_of": "2025-02-19", "fixed_in": "2.12.5", "note": "From IVPN's iOS changelog.", "evidence": "Potential DNS leak during automatic WireGuard key rotation", "source_url": "https://raw.githubusercontent.com/ivpn/ios-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "DNS leak through link-local IPv6 addresses", "platforms": [ "linux" ], "status": "fixed", "as_of": "2022-07-21", "fixed_in": "3.9.0", "note": "From IVPN's desktop changelog.", "evidence": "potential DNS leak via the link-local IPv6 addresses", "source_url": "https://raw.githubusercontent.com/ivpn/desktop-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "linux" ], "version": "3.15.15", "released": "2026-09-03", "evidence": "Version 3.15.15 - 2026-09-03", "source_url": "https://raw.githubusercontent.com/ivpn/desktop-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "3.16.1", "released": "2026-10-08", "evidence": "v3.16.1", "source_url": "https://github.com/ivpn/desktop-app/releases/tag/v3.16.1", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "2.14.2", "released": "2026-06-11", "evidence": "2.14.2 - 2026-06-11", "source_url": "https://raw.githubusercontent.com/ivpn/ios-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "2.13.1", "released": "2026-06-24", "evidence": "Version 2.13.1 - 2026-06-24", "source_url": "https://raw.githubusercontent.com/ivpn/android-app/master/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-04-11", "scope_type": "backend", "scope": "Customer website, API, web servers and web infrastructure, in a test environment without production access.", "findings": { "low": 2, "info": 2 }, "public": true, "report_url": "https://cure53.de/pentest-report_IVPN_2024.pdf", "evidence": "The Cure53 team conducted the audit over 8 days in March 2024.", "source_url": "https://www.ivpn.net/blog/ivpn-sixth-security-audit-concluded/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2023-03-15", "scope_type": "infrastructure", "scope": "Operating system and setup of the upgraded VPN gateway servers, in a test environment without production access.", "findings": { "medium": 1, "low": 6, "info": 1 }, "public": true, "report_url": "https://cure53.de/pentest-report_IVPN_2023.pdf", "evidence": "Cure53 team conducted the audit over 6 days in February 2023", "source_url": "https://www.ivpn.net/blog/ivpn-infrastructure-audit-concluded/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "monthly signed canary", "canary_updated": "2026-10-06", "note": "A PGP-signed canary: no warrants, searches, seizures or backdoor requests to date.", "evidence": "no warrants have ever been served to IVPN or IVPN employees.", "source_url": "https://www.ivpn.net/resources/canary.txt", "source_type": "html", "requests": null, "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "IVPN Limited", "country": "Gibraltar", "note": "Named on IVPN's transparency page.", "evidence": "IVPN is operated by IVPN Limited, registered in Gibraltar.", "source_url": "https://www.ivpn.net/en/transparency-report/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "incident", "date": "2026-08", "type": "server_compromise", "summary": "Attackers exploited a BTCPay Server flaw on IVPN's self-hosted Bitcoin payment server and moved out IVPN's operating funds.", "provider_response": "IVPN said no customer data or customer funds were affected.", "evidence": "No customer data was accessed, no customer funds were lost", "source_url": "https://www.ivpn.net/blog/security-incident-bitcoin-payment-server/", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "IVPN's desktop, iOS and Android apps are public on GitHub.", "repo_url": "https://github.com/ivpn", "evidence": "IVPN for Desktop is the official IVPN app for desktop platforms.", "source_url": "https://github.com/ivpn/desktop-app", "source_type": "github", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "infra_audit", "detail": "IVPN commissions an annual security audit from Cure53.", "evidence": "we have scheduled our eighth annual security audit with Cure53", "source_url": "https://www.ivpn.net/blog/annual-security-audit-scheduled-2026/", "source_type": "blog", "verified_at": "2026-10-19" } ] }, { "provider": "kaspersky-vpn", "provider_name": "Kaspersky VPN", "page": "https://myipscan.net/vpn/kaspersky-vpn-leak-test/", "facts": [ { "kind": "audit", "auditor": "AV-Test", "published": "2024-02-06", "scope_type": "apps", "scope": "A test commissioned by Kaspersky of the Windows and Android apps: speed, encryption and IP leak protection. Not a no-logs or infrastructure audit.", "public": true, "report_url": "https://www.av-test.org/fileadmin/pdf/reports/AV-TEST_Kaspersky_VPN_Test_Dec_2023.pdf", "evidence": "AV-TEST conducted a comprehensive independent evaluation of Kaspersky's VPN Secure Connection", "source_url": "https://www.av-test.org/en/news/kaspersky-vpn-test-report-2023/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "H1 2026, all Kaspersky products", "requests": 64, "note": "Company-wide, not specific to the VPN: Kaspersky reports one of the processed requests sought user data.", "evidence": "Law Enforcement and Government Requests, H1 2026", "source_url": "https://content.kaspersky-labs.com/se/media/en/reports/kaspersky-law-enforcement-requests-report-h1-2026.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "AO Kaspersky Lab", "country": "Russia", "note": "Named as the copyright holder on the VPN product page.", "evidence": "AO Kaspersky Lab", "source_url": "https://www.kaspersky.co.uk/vpn-secure-connection", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "lantern", "provider_name": "Lantern", "page": "https://myipscan.net/vpn/lantern-leak-test/", "facts": [ { "kind": "owner", "entity": "Brave New Software Project, Inc.", "country": "United States", "note": "A 501(c)(3) nonprofit.", "evidence": "Brave New Software Project, Inc. 4845 Pearl East Cir Ste 118 #318052 Boulder, CO", "source_url": "https://lantern.io/terms", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "NCC Group", "published": "2022-05-05", "scope_type": "apps", "scope": "White-box assessment of the Lantern client on Windows, Android and iOS, with a 2022 review after remediation", "public": true, "report_url": "https://www.nccgroup.com/media/iy3f4g2k/_ncc_group_innovatelabsllc_lant001_report_2022-05-05_v11-final.pdf", "evidence": "NCC Group re-evaluated findings in 2022 after remediation work was completed.", "source_url": "https://lantern.io/security-audits", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Lantern's codebase is public on GitHub.", "repo_url": "https://github.com/getlantern/lantern", "evidence": "entire codebase is available for anyone to inspect, contribute to, or build on", "source_url": "https://lantern.io/security-audits", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "malwarebytes-privacy-vpn", "provider_name": "Malwarebytes Privacy VPN", "page": "https://myipscan.net/vpn/malwarebytes-privacy-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Malwarebytes Inc.", "country": "United States", "note": "Outside the US and Canada the EULA names Malwarebytes Limited, Ireland.", "evidence": "MALWAREBYTES INC., A DELAWARE CORPORATION", "source_url": "https://www.malwarebytes.com/eula", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "auditor": "X41 D-Sec", "published": "2026-04-02", "scope_type": "infrastructure", "scope": "Server infrastructure shared with AzireVPN: hardware and server-side software", "findings": { "critical": 2, "medium": 2, "low": 2 }, "public": true, "report_url": "https://www.malwarebytes.com/wp-content/uploads/sites/2/2026/03/X41-DSec-Audit-AzireVPN-Public.pdf", "evidence": "X41 D-Sec found two critical issues.", "source_url": "https://www.malwarebytes.com/blog/product/2026/04/vpnsoftwareaudit", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Malwarebytes says all servers run entirely in RAM and are prepared without disks.", "evidence": "All servers run entirely in RAM and are physically prepared without disks", "source_url": "https://www.malwarebytes.com/vpn", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "mozilla-vpn", "provider_name": "Mozilla VPN", "page": "https://myipscan.net/vpn/mozilla-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No Mozilla VPN advisory on it.", "source_url": "https://www.mozilla.org/en-US/security/advisories/", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Captive-portal check ran outside the tunnel", "platforms": [ "windows", "macos", "linux", "android", "ios" ], "status": "fixed", "as_of": "2023-12-06", "fixed_in": "the fixes after the 2023 Cure53 audit, version not named", "note": "Found in Mozilla's 2023 audit: the captive-portal check no longer runs outside the VPN tunnel.", "evidence": "no longer pinging for a captive portal outside of the VPN tunnel", "source_url": "https://blog.mozilla.org/security/2023/12/06/mozilla-vpn-security-audit-2023/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "all" ], "version": "2.39.0", "released": "2026-07-22", "evidence": "v2.39.0", "source_url": "https://github.com/mozilla-mobile/mozilla-vpn-client/releases/tag/v2.39.0", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2023-12-06", "scope_type": "apps", "scope": "The VPN apps for macOS, Linux, Windows, iOS and Android, tested in 2023; two items rated critical or high, all addressed.", "public": true, "report_url": "https://blog.mozilla.org/security/files/2023/12/Cure53-Final-Audit-Report.pdf", "evidence": "we are releasing a security audit of Mozilla VPN that Cure53 conducted earlier this year", "source_url": "https://blog.mozilla.org/security/2023/12/06/mozilla-vpn-security-audit-2023/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2021-09-01", "scope_type": "apps", "scope": "The Mozilla VPN apps, tested in March 2021.", "findings": { "high": 1, "medium": 2 }, "public": true, "report_url": "https://blog.mozilla.org/security/files/2021/08/FVP-02-report.final_.pdf", "evidence": "there were two medium and one high severity issues that were discovered", "source_url": "https://blog.mozilla.org/en/mozilla/news/mozilla-vpn-completes-independent-security-audit-by-cure53/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Mozilla Corporation", "country": "United States", "parent": "Mozilla Foundation", "note": "Mozilla offers the VPN in partnership with Mullvad.", "evidence": "a wholly owned subsidiary of the Mozilla Foundation", "source_url": "https://www.mozilla.org/en-US/about/governance/organizations/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The Mozilla VPN client source is public on GitHub.", "repo_url": "https://github.com/mozilla-mobile/mozilla-vpn-client", "evidence": "We encourage you to participate in this open source project.", "source_url": "https://github.com/mozilla-mobile/mozilla-vpn-client", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "mullvad", "provider_name": "Mullvad", "page": "https://myipscan.net/vpn/mullvad-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "macos", "linux", "android" ], "status": "not_affected", "as_of": "2023-08-09", "note": "Traffic outside the tunnel is blocked; with local network sharing on, only reserved local ranges are allowed.", "evidence": "On Windows, Linux, macOS and Android we are not vulnerable to the LocalNet attack", "source_url": "https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "ios" ], "status": "mitigated", "as_of": "2026-04-21", "fixed_in": "the Force all apps setting, iOS 2026.2", "note": "Affected at disclosure. Version 2026.2 added a \"Force all apps\" setting that mitigates it; the setting has to be switched on.", "evidence": "Add support for \"Force all apps\", which mitigates", "source_url": "https://github.com/mullvad/mullvadvpn-app/blob/main/ios/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "windows", "macos", "linux", "android", "ios" ], "status": "not_affected", "as_of": "2023-08-09", "note": "The app gets server addresses from Mullvad's own API, not from DNS, so a spoofed DNS answer has nothing to change.", "evidence": "not vulnerable to any part of the Server IP attack vector on any platform", "source_url": "https://mullvad.net/en/blog/2023/8/9/response-to-tunnelcrack-vulnerability-disclosure", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "linux" ], "status": "not_affected", "as_of": "2024-05-07", "note": "Firewall rules block traffic to public addresses outside the tunnel, so pushed routes cannot expose it.", "evidence": "effectively prevent both LocalNet and TunnelVision", "source_url": "https://mullvad.net/en/blog/2024/5/7/evaluating-the-impact-of-tunnelvision", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-07", "note": "Android does not implement DHCP option 121, the route-pushing mechanism the attack needs.", "evidence": "does not implement DHCP option 121", "source_url": "https://mullvad.net/en/blog/2024/5/7/evaluating-the-impact-of-tunnelvision", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-07", "note": "Mullvad said the fix is probably the same as for LocalNet. It has not said whether the 2026.2 \"Force all apps\" setting also covers TunnelVision.", "evidence": "is unfortunately vulnerable to TunnelVision", "source_url": "https://mullvad.net/en/blog/2024/5/7/evaluating-the-impact-of-tunnelvision", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "2026.5", "released": "2026-09-11", "evidence": "[2026.5] - 2026-09-11", "source_url": "https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "2026.12", "released": "2026-09-30", "evidence": "[android/2026.12] - 2026-09-30", "source_url": "https://github.com/mullvad/mullvadvpn-app/blob/main/android/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "2026.5", "released": "2026-09-08", "evidence": "[2026.5 - 2026-09-08]", "source_url": "https://github.com/mullvad/mullvadvpn-app/blob/main/ios/CHANGELOG.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2026-06-01", "scope_type": "apps", "scope": "Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review.", "public": true, "report_url": "https://github.com/mullvad/mullvadvpn-app/blob/main/audits/2026-02-17-leviathan-masa.md", "evidence": "a standardized security assessment, conducted by Leviathan Security Group", "source_url": "https://mullvad.net/en/blog/2026-security-assessment-of-our-android-app", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2026-03-06", "scope_type": "protocol", "scope": "GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded.", "findings": { "low": 2 }, "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_GotaTun_Code_Review_2026.pdf", "evidence": "An independent audit by Assured Security Consultants is now available.", "source_url": "https://mullvad.net/en/blog/a-security-audit-of-gotatun-is-now-available", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "X41 D-Sec", "published": "2026-01-21", "scope_type": "backend", "scope": "White-box review of the account and payment API and backend; some findings redacted.", "findings": { "medium": 3, "low": 2 }, "public": true, "report_url": "https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2026-01-20.pdf", "evidence": "X41 D‑Sec GmbH performed a white‑box source‑code audit", "source_url": "https://mullvad.net/en/blog/new-security-audit-of-account-and-payment-services", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2025-10-23", "scope_type": "backend", "scope": "Penetration test of the customer web app.", "findings": { "critical": 0, "high": 0, "medium": 0, "low": 1 }, "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_Web_App_Pentest_2025.pdf", "evidence": "Assured completed an independent security assessment of our web app.", "source_url": "https://mullvad.net/en/blog/independent-security-audit-of-our-web-app-completed-by-assured", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2025-05-19", "scope_type": "apps", "scope": "The installer and downloader (VPN loader): protocol and source code.", "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_Installer_Downloader_Audit_2025.pdf", "evidence": "independently audited by security experts at Assured", "source_url": "https://mullvad.net/en/blog/launching-mullvad-vpn-loader", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "NCC Group", "published": "2025-03-27", "scope_type": "apps", "scope": "Android app 2024.9 against the MASA profile; black-box, no code reviewed.", "public": true, "report_url": "https://appdefensealliance.dev/reports/net.mullvad.mullvadvpn_1740398400000000.pdf", "evidence": "a standardized security assessment, conducted by NCC Group", "source_url": "https://mullvad.net/en/blog/successful-security-assessment-of-our-android-app", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "X41 D-Sec", "published": "2024-12-11", "scope_type": "apps", "scope": "Penetration test and source review of the VPN app on all platforms, October to November 2024.", "findings": { "critical": 0, "high": 3, "medium": 2, "low": 1 }, "public": true, "report_url": "https://www.x41-dsec.de/static/reports/X41-Mullvad-Audit-Public-Report-2024-12-10.pdf", "evidence": "Four people from X41 D-Sec performed a penetration test and source code audit", "source_url": "https://mullvad.net/en/blog/the-report-for-the-2024-security-audit-of-the-app-is-now-available", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-06-27", "scope_type": "infrastructure", "scope": "One OpenVPN and one WireGuard staging server plus the Ansible code, with a privacy focus.", "findings": { "medium": 1, "low": 1 }, "public": true, "report_url": "https://cure53.de/pentest-report_mullvad_2024_v1.pdf", "evidence": "We contracted Cure53 with performing a security audit towards our VPN infrastructure", "source_url": "https://mullvad.net/en/blog/fourth-infrastructure-audit-completed-by-cure53", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Radically Open Security", "published": "2023-08-09", "scope_type": "infrastructure", "scope": "Two RAM-only VPN servers, including a check for logging; binaries and hardware excluded.", "public": false, "evidence": "Radically Open Security found no information leakage or logging of customer data", "source_url": "https://mullvad.net/en/blog/infrastructure-audit-completed-by-radically-open-security", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2023-02-17", "scope_type": "backend", "scope": "Account and payment API, tested in November 2022.", "findings": { "critical": 0, "high": 0, "medium": 0 }, "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_API_audit_report_2022.pdf", "evidence": "No critical, high or medium rated issues were identified during the penetration test", "source_url": "https://mullvad.net/en/blog/security-audit-of-account-and-payment-services", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Atredis Partners", "published": "2022-10-21", "scope_type": "apps", "scope": "Penetration test and source audit of the apps on five platforms.", "public": true, "report_url": "https://www.atredis.com/s/Atredis-Partners-Mullvad-VPN-Platform-Security-Assessment-Report-v10.pdf", "evidence": "Atredis Partners have just performed a penetration test and source code audit of our app", "source_url": "https://mullvad.net/en/blog/security-audit-report-for-our-app-available", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2022-09-14", "scope_type": "infrastructure", "scope": "Self-hosted authoritative DNS servers, before they went into production.", "findings": { "critical": 0, "high": 0 }, "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_DNS_server_audit_report_2022.pdf", "evidence": "These servers were audited by Assured AB", "source_url": "https://mullvad.net/en/blog/authoritative-dns-server-audit-completed-by-assured-ab", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Assured", "published": "2022-06-22", "scope_type": "no-logs", "scope": "Two WireGuard and one OpenVPN server, freshly installed: configuration and any customer logging.", "public": true, "report_url": "https://www.assured.se/publications/Assured_Mullvad_relay_server_audit_report_2022.pdf", "evidence": "Assured AB found no information leakage or logging of customer data", "source_url": "https://mullvad.net/en/blog/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2021-01-20", "scope_type": "infrastructure", "scope": "First infrastructure audit, December 2020; six issues from informational to high, no breakdown given.", "public": true, "report_url": "https://cure53.de/pentest-report_mullvad_2021_v1.pdf", "evidence": "Cure53 identified six (6) vulnerabilities that ranged from", "source_url": "https://mullvad.net/en/blog/no-pii-or-privacy-leaks-found-cure53s-infrastructure-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2020-06-25", "scope_type": "apps", "scope": "Desktop 2020.4, Android and iOS apps; the worst finding was rated medium.", "public": true, "report_url": "https://cure53.de/pentest-report_mullvad_2020_v2.pdf", "evidence": "Six testers from Cure53 performed the audit over the course of 20 days.", "source_url": "https://mullvad.net/en/blog/results-available-audit-mullvad-app", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "the April 2023 police search", "note": "No regular report or canary. Mullvad disclosed a police search in April 2023; officers left without customer data.", "evidence": "They intended to seize computers with customer data.", "source_url": "https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/", "source_type": "blog", "requests": null, "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Mullvad VPN AB", "country": "Sweden", "parent": "Amagicom AB", "note": "Both companies are owned by the two founders.", "evidence": "Mullvad VPN AB is owned by parent company Amagicom AB.", "source_url": "https://mullvad.net/en/about", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "incident", "date": "2023-04-18", "type": "logs_tested", "summary": "Swedish police came to Mullvad's office with a search warrant for customer data and left without seizing anything.", "provider_response": "Mullvad said such customer data did not exist under its policies.", "evidence": "In line with our policies such customer data did not exist.", "source_url": "https://mullvad.net/en/blog/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "All VPN servers run from RAM without disks since September 2023.", "evidence": "Today we announce that we have completely removed all traces of disks", "source_url": "https://mullvad.net/en/blog/we-have-successfully-completed-our-migration-to-ram-only-vpn-infrastructure", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "infra_audit", "detail": "Mullvad says its RAM-only infrastructure has been audited twice.", "evidence": "Our VPN infrastructure has since been audited with this configuration twice", "source_url": "https://mullvad.net/en/blog/we-have-successfully-completed-our-migration-to-ram-only-vpn-infrastructure", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Desktop and mobile client source is public on GitHub (GPL-3.0).", "repo_url": "https://github.com/mullvad/mullvadvpn-app", "evidence": "The Mullvad VPN client app for desktop and mobile", "source_url": "https://github.com/mullvad/mullvadvpn-app", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "mysterium-vpn", "provider_name": "Mysterium VPN", "page": "https://myipscan.net/vpn/mysterium-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "UAB MN Intelligence", "country": "Lithuania", "note": "The country is inferred from the 'UAB' legal form, which is a Lithuanian private limited company. The site gives no registered address. The Terms choose Panama law and Panama courts: 'construed in accordance with the laws of the Republic of Panama'. The about page says the provider built its first decentralized VPN in 2019. No parent company is stated on mysteriumvpn.com.", "evidence": "a binding legal agreement between you and UAB MN Intelligence", "source_url": "https://www.mysteriumvpn.com/terms-conditions-vpn", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Checked the homepage, /about-us, /privacy-policy-vpn and /terms-conditions-vpn. They cite open-source app code and VPN Trust Initiative membership. The privacy policy mentions only generic 'regular audits'. No named auditor or published report was found. The privacy policy also says it processes email address, bandwidth usage volumes and session timestamps alongside its no-logs pledge.", "source_url": "https://www.mysteriumvpn.com/about-us", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The node software run by exit-node operators is open source under GPL-3.0. This is server-side node software, not the end-user app.", "repo_url": "https://github.com/mysteriumnetwork/node", "evidence": "official implementation of distributed VPN network", "source_url": "https://github.com/mysteriumnetwork/node", "source_type": "github", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "No RAM-only claim was found. Traffic exits through residential IPs run by independent node operators, not through provider-run servers.", "evidence": "residential IPs come from independent node operators who explicitly agreed to take part", "source_url": "https://www.mysteriumvpn.com/about-us", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-21", "note": "The homepage claims a kill switch without naming platforms. No TunnelVision or TunnelCrack statement was found.", "source_url": "https://www.mysteriumvpn.com/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2026-07-08", "type": "other", "summary": "CVE-2026-31309: an unauthenticated request to Mysterium Node's /tequilapi/config/user endpoint could overwrite its configuration and take over the node (versions 1.21.1-rc0 to before 1.36.0).", "provider_response": "Fixed in node v1.36.0. NVD links fix commit bc099fcaff59 in mysteriumnetwork/node.", "evidence": "Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-31309", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "netbird", "provider_name": "NetBird", "page": "https://myipscan.net/vpn/netbird-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No GitHub advisory or issue mentions it. NetBird is a mesh overlay and does not route all traffic by default.", "source_url": "https://github.com/netbirdio/netbird/security/advisories", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in NetBird's advisories or issues.", "source_url": "https://github.com/netbirdio/netbird/security/advisories", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in NetBird's advisories or issues.", "source_url": "https://github.com/netbirdio/netbird/security/advisories", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "0.81.2", "released": "2026-10-16", "evidence": "v0.81.2", "source_url": "https://github.com/netbirdio/netbird/releases/tag/v0.81.2", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "0.6.1", "released": "2026-09-22", "evidence": "v0.6.1", "source_url": "https://github.com/netbirdio/android-client/releases/tag/v0.6.1", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "0.4.1", "released": "2026-09-24", "evidence": "v0.4.1", "source_url": "https://github.com/netbirdio/ios-client/releases/tag/v0.4.1", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "NetBird GmbH", "country": "Germany", "note": "Registered in Berlin.", "evidence": "NetBird GmbH", "source_url": "https://netbird.io/imprint", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "status": "none_found", "note": "netbird.io, its GitHub README and docs name no independent audit; the trust centre loads only with JavaScript.", "source_url": "https://netbird.io/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "NetBird's source is public (BSD-3, with AGPLv3 server parts).", "repo_url": "https://github.com/netbirdio/netbird", "evidence": "the platform is distributed under a permissive BSD-3 license and can be self-hosted", "source_url": "https://netbird.io/", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "nordlayer", "provider_name": "NordLayer", "page": "https://myipscan.net/vpn/nordlayer-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No NordLayer statement found in its blog, help center or release notes.", "source_url": "https://help.nordlayer.com/docs/windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No NordLayer statement found in its blog, help center or release notes.", "source_url": "https://help.nordlayer.com/docs/windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No NordLayer statement found in its blog, help center or release notes.", "source_url": "https://help.nordlayer.com/docs/windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "4.0.0", "released": "2026-09-14", "evidence": "Windows 4.0.0", "source_url": "https://help.nordlayer.com/docs/windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "3.12.1", "released": "2026-08-25", "evidence": "macOS 3.12.1", "source_url": "https://help.nordlayer.com/docs/macos", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "3.6.0", "released": "2026-10-14", "evidence": "Linux 3.6.0", "source_url": "https://help.nordlayer.com/docs/linux", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "4.18.1", "released": "2026-09-07", "evidence": "Android 4.18.1", "source_url": "https://help.nordlayer.com/docs/android", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "4.13.0", "released": "2026-08-20", "evidence": "iOS 4.13.0", "source_url": "https://help.nordlayer.com/docs/ios", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "browser" ], "version": "2.5.2", "released": "2026-06-29", "evidence": "NordLayer Browser Extension 2.5.2", "source_url": "https://help.nordlayer.com/docs/browser-extension", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Nord Security Inc.", "country": "United States", "note": "New York address in the privacy policy; NordLayer is a Nord Security brand.", "evidence": "Personal data provided in this Privacy Policy is processed by Nord Security Inc.", "source_url": "https://nordlayer.com/privacy-policy/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "nordvpn", "provider_name": "NordVPN", "page": "https://myipscan.net/vpn/nordvpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "linux", "android" ], "status": "not_affected", "as_of": "2026-10-18", "undated": true, "note": "NordVPN says these apps were immune thanks to existing mitigations; on Windows and Linux the OS firewall keeps traffic in the tunnel.", "evidence": "while our Android, Linux, and Windows clients were immune due to implemented mitigations", "source_url": "https://support.nordvpn.com/hc/en-us/articles/25202605194257-Invisibility-on-a-local-network-why-we-had-to-build-a-broken-feature", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2026-10-18", "fixed_in": "the Stay invisible on a local network setting", "undated": true, "note": "Affected by default. The setting also covers DHCP option 121 routes, but NordVPN says Apple bugs can break the app with it on (iOS 17 and later).", "evidence": "Does the feature protect users from TunnelVision utilizing Option 121, too? Yes, it does.", "source_url": "https://support.nordvpn.com/hc/en-us/articles/25202605194257-Invisibility-on-a-local-network-why-we-had-to-build-a-broken-feature", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "linux", "android" ], "status": "not_affected", "as_of": "2026-10-18", "undated": true, "note": "NordVPN says these apps were immune due to implemented mitigations.", "evidence": "while our Android, Linux, and Windows clients were immune due to implemented mitigations", "source_url": "https://support.nordvpn.com/hc/en-us/articles/25202605194257-Invisibility-on-a-local-network-why-we-had-to-build-a-broken-feature", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2026-10-18", "fixed_in": "the Stay invisible on a local network setting", "undated": true, "note": "The setting was fully released by the beginning of August 2023 and has to be switched on.", "evidence": "The feature was fully released by the beginning of August 2023.", "source_url": "https://support.nordvpn.com/hc/en-us/articles/25202605194257-Invisibility-on-a-local-network-why-we-had-to-build-a-broken-feature", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "NordVPN's article covers only the local network attack, not ServerIP.", "source_url": "https://support.nordvpn.com/hc/en-us/articles/25202605194257-Invisibility-on-a-local-network-why-we-had-to-build-a-broken-feature", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "5.4.1", "released": "2026-10-13", "evidence": "5.4.1 2026-10-13", "source_url": "https://github.com/NordSecurity/nordvpn-linux/releases/tag/5.4.1", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2025-02-18", "scope_type": "no-logs", "scope": "Deloitte Audit Lithuania, fifth engagement, with access from 18 November to 20 December 2024.", "public": false, "evidence": "commissioned Deloitte Audit Lithuania to conduct an independent assurance report", "source_url": "https://nordsecurity.com/press-area/nordvpn-verifies-its-no-logs-assurance-assessment-for-the-fifth-time/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The NordVPN Linux app is open source; the rest of the service is proprietary.", "repo_url": "https://github.com/NordSecurity/nordvpn-linux", "evidence": "The Linux CLI and GUI are now open-source, and contributions are welcome via GitHub", "source_url": "https://support.nordvpn.com/hc/en-us/articles/35078364516625-How-to-use-NordVPN-Linux-GUI", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "owner", "entity": "nordvpn S.A.", "country": "Panama", "parent": "Nord Security", "note": "NordVPN's support page names nordvpn S.A.; Nord Security's company history lists NordVPN as its first product.", "evidence": "NordVPN is owned and operated by nordvpn S.A.", "source_url": "https://support.nordvpn.com/hc/en-us/articles/20911146148113-The-founders-and-owners-of-NordVPN", "source_type": "html", "verified_at": "2026-10-20" } ] }, { "provider": "norton-vpn", "provider_name": "Norton VPN", "page": "https://myipscan.net/vpn/norton-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-07-02", "note": "A Norton representative replied on Norton's community that the company was discussing it; we found no follow-up.", "source_url": "https://community.norton.com/t/tunnelvision/231809", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Real IP shown on IPv6-only networks", "platforms": [ "all" ], "status": "mitigated", "as_of": "2026-09-01", "fixed_in": "turning IPv6 off on the device", "note": "Norton says its VPN works over IPv4 only, so on an IPv6 network the real address can show.", "evidence": "Norton VPN still shows your real public IP address", "source_url": "https://support.norton.com/sp/en/us/home/current/solutions/v133522079", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Gen Digital Inc.", "country": "United States", "note": "Norton is a Gen brand. Norton VPN pages say 'Norton is part of Gen', and the 2024 VerSprite report was done 'on behalf of GenDigital'. Gen has dual headquarters, Prague (CZ) and Tempe (US); the country is recorded as US for Tempe. The state of incorporation was not checked.", "evidence": "Our global workforce has dual headquarters in Prague, Czech Republic and Tempe, Arizona, USA", "source_url": "https://www.gendigital.com/us/en/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "android", "ios" ], "status": "not_stated", "as_of": "2026-10-21", "note": "A kill switch is documented for Android, Mac, Windows and iOS. No TunnelVision or TunnelCrack statement was found, and the static HTML of Gen's security advisories page has no VPN entry.", "source_url": "https://support.norton.com/sp/en/us/home/current/solutions/v138204009", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2026-05-04", "type": "other", "summary": "CVE-2025-58074: a low-privilege user could replace files while Norton Secure VPN installs from the Microsoft Store, leading to file deletion and privilege escalation (Talos TALOS-2025-2276).", "provider_response": "NVD's vendor reference is a Norton notice retiring two other Microsoft Store apps (Norton Security Protection, Norton Security On-the-Go) after Feb 28, 2026; it does not mention Secure VPN. The NVD record gives no fixed version.", "evidence": "privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-58074", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "opera-vpn", "provider_name": "Opera VPN", "page": "https://myipscan.net/vpn/opera-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "browser" ], "status": "not_affected", "as_of": "2024-06-12", "note": "Opera's free VPN in the desktop and Android browser carries only browser traffic and does not rely on the device's DHCP routes.", "evidence": "Opera's free VPN only protects your activity within the browser", "source_url": "https://blogs.opera.com/security/2024/06/tunnelvision-vulnerability-opera-vpn/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "not_stated", "as_of": "2024-06-12", "note": "Opera said it was still evaluating the iOS app; we found no follow-up.", "evidence": "We are currently evaluating whether the iOS version of our free VPN is at risk", "source_url": "https://blogs.opera.com/security/2024/06/tunnelvision-vulnerability-opera-vpn/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2024-09-25", "scope_type": "no-logs", "scope": "Infrastructure of the free browser VPN on desktop, Android and iOS, June to August 2024; Opera VPN Pro excluded.", "public": false, "evidence": "The audit was conducted by Deloitte", "source_url": "https://blogs.opera.com/security/2024/09/opera-free-browser-vpn-no-log-audit-deloitte/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2022-03-30", "scope_type": "full", "scope": "VPN backend plus desktop and mobile clients; only a summary report is published.", "public": true, "report_url": "https://cure53.de/summary-report_opera-vpn.pdf", "evidence": "The audit of our browser VPN was conducted by Cure53", "source_url": "https://blogs.opera.com/security/2022/03/operas-free-browser-vpn-completes-independent-security-audit-by-cure53/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Jan-Jun 2026", "requests": 20, "note": "Law enforcement requests; Opera reports disclosing user data in none of them.", "evidence": "Number of law enforcement requests: 20", "source_url": "https://security.opera.com/en/opera-transparency-report/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Opera Norway AS", "country": "Norway", "parent": "Opera Limited", "note": "Opera Limited is listed on NASDAQ (OPRA).", "evidence": "including Opera Norway AS (a Norwegian company) which develops and publishes the Opera browsers", "source_url": "https://legal.opera.com/privacy/privacy.html", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "ovpn", "provider_name": "OVPN", "page": "https://myipscan.net/vpn/ovpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-15", "note": "No TunnelVision post on OVPN's blog or help centre, up to its latest client post.", "source_url": "https://www.ovpn.com/en/blog/mac-fix", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2023-09-13", "note": "Client 2.8 added an optional Block LAN setting without mentioning TunnelCrack.", "source_url": "https://www.ovpn.com/en/blog/desktop-client-v28-block-lan-and-improvements", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2023-09-13", "note": "No OVPN statement found.", "source_url": "https://www.ovpn.com/en/blog/desktop-client-v28-block-lan-and-improvements", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "IP leak with the always-on kill switch", "platforms": [ "windows", "macos", "linux" ], "status": "fixed", "as_of": "2022-08-16", "fixed_in": "2.2.1", "note": "From OVPN's desktop client release post.", "evidence": "resolved an issue where IP would leak with always-on killswitch under specific circumstances", "source_url": "https://www.ovpn.com/en/blog/desktop-client-v221-bug-fixes", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "DNS leak on Fedora", "platforms": [ "linux" ], "status": "fixed", "as_of": "2023-01-10", "fixed_in": "2.4", "note": "From OVPN's desktop client release post.", "evidence": "DNS no longer leaks on Fedora", "source_url": "https://www.ovpn.com/en/blog/desktop-client-v24-dns-fixes-and-start-minimized", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "2.21.1", "released": "2026-10-15", "evidence": "List of changes in v2.21.1", "source_url": "https://www.ovpn.com/en/blog/mac-fix", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "September 2026", "requests": 0, "note": "OVPN publishes a monthly report with requests, traffic and uptime.", "evidence": "During the month of September, we received 0 requests", "source_url": "https://www.ovpn.com/en/blog/transparency-report-september-2026", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "OVPN Inc.", "note": "OVPN was acquired by OVPN Inc. in 2025; the registration country is not stated.", "evidence": "In 2025, OVPN was acquired by OVPN Inc.", "source_url": "https://www.ovpn.com/en/privacy-notice", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "status": "none_found", "note": "OVPN's security page and all 498 blog post titles mention no audit or pentest.", "source_url": "https://www.ovpn.com/en/security", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "incident", "date": "2020-09-10", "type": "logs_tested", "summary": "Rights holders sought an information injunction in the Swedish Patent and Market Court, which found no evidence that OVPN stores logs.", "provider_response": "OVPN published the ruling and the case files.", "evidence": "OVPN therefore wins the information injunction as our statements and evidence regarding", "source_url": "https://www.ovpn.com/en/blog/ovpn-wins-court-order", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Servers run without hard drives and boot a signed OS image into RAM.", "evidence": "All servers operate without any hard drives", "source_url": "https://www.ovpn.com/en/security", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "perfect-privacy", "provider_name": "Perfect Privacy", "page": "https://myipscan.net/vpn/perfect-privacy-leak-test/", "facts": [ { "kind": "owner", "entity": "CyberDock IT Solutions GmbH", "country": "Germany", "note": "Imprint gives Stahltwiete 21, 22761 Hamburg, Amtsgericht Hamburg HRB 152750. The live site was unreachable on 2026-10-21 (DNS SERVFAIL for perfect-privacy.com), so the archived imprint (snapshot 2025-11-22) was used. Until at least the 2023-04-05 snapshot the imprint named VECTURA DATAMANAGEMENT LIMITED COMPANY, Chamerstrasse 172, 6300 Zug, Switzerland, CHE-445.031.921 (https://web.archive.org/web/20230405070349/https://www.perfect-privacy.com/en/imprint). The 2023-05-02 snapshot already has the CyberDock text, so the change happened between those dates. The warrant canary says 'as Perfect Privacy is based in Germany'. The brand dates from 2008 ('Since our establishment in 2008', no-logs page). No parent company is stated.", "evidence": "CyberDock IT Solutions GmbH", "source_url": "https://web.archive.org/web/20251122133231/https://www.perfect-privacy.com/en/imprint", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "No independent audit of Perfect Privacy's apps, servers or no-logs claim was found. Checked archived copies (live site down 2026-10-21): FAQ (2025-12-08), no-logs feature page (2025-08-15), warrant canary, imprint and the Wayback index of /en/blog/. The only audit-titled post is 'openvpn-code-audit-ostif', which by its slug is about the OSTIF audit of OpenVPN itself; it was not read.", "source_url": "https://web.archive.org/web/20251208012039/https://www.perfect-privacy.com/en/faq", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "macos" ], "status": "not_affected", "as_of": "2023-08-28", "note": "This is the provider's own claim in a blog post dated Aug 28, 2023. The protection relies on the client firewall; the FAQ says the Windows and macOS VPN app has integrated firewall protection. Mobile and router setups are not discussed. No TunnelVision (CVE-2024-3661) post was found in the archived blog index.", "evidence": "a robust firewall that prevents LocalNet Attacks by allowing packets to flow only through", "source_url": "https://web.archive.org/web/20250325110251/https://www.perfect-privacy.com/en/blog/tunnelcrack-a-combination-of-vulnerabilities-in-vpn-security", "source_type": "blog", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "windows", "macos" ], "status": "not_affected", "as_of": "2023-08-28", "note": "Provider claim from the same Aug 28, 2023 post: its client connects to IP addresses rather than via public DNS, and its firewall blocks non-VPN-port packets to the server IP. The post cites Perfect Privacy's own 2015 'Port Fail' disclosure.", "evidence": "Perfect Privacy avoids ServerIP Attacks by connecting directly to IPs instead of using public DNS", "source_url": "https://web.archive.org/web/20250325110251/https://www.perfect-privacy.com/en/blog/tunnelcrack-a-combination-of-vulnerabilities-in-vpn-security", "source_type": "blog", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Perfect Privacy says all services run in encrypted RAM disks, so data cannot be written to hard drives. The same claim appears in its 2020 answers to TorrentFreak ('they all are running within RAM disks only'). No independent verification was found.", "evidence": "All our services are running within strongly encrypted RAM disks", "source_url": "https://web.archive.org/web/20250815200833/https://www.perfect-privacy.com/en/features/without-logs", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The desktop VPN client (Windows/macOS build targets) is published on GitHub under GPL-3.0. The repo was created 2023-02-07 and last pushed 2024-07-29. A separate perfect-privacy/android-vpn-client repo (IPsec-based Android client) also exists.", "repo_url": "https://github.com/perfect-privacy/vpn-client", "evidence": "Perfect Privacy VPN Client", "source_url": "https://github.com/perfect-privacy/vpn-client", "source_type": "github", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2016-08-24", "type": "server_seizure", "summary": "Dutch authorities seized two Perfect Privacy servers in Rotterdam from its hosting provider I3D. The provider was not contacted directly. I3D supplied replacement servers on the same IP addresses.", "provider_response": "Perfect Privacy said it keeps no logs, so no user data was believed compromised. In an update of 22 Sept 2016 it said the servers had been returned (disks sent to I3D's wipe queue) and 'We can now conclude that no customer information was compromised due to the seizure.' TorrentFreak also covered the seizure (https://torrentfreak.com/police-seize-two-perfect-privacy-vpn-servers-160902/).", "evidence": "Today our hoster I3D informed us that the Dutch authorities have seized two servers", "source_url": "https://web.archive.org/web/20250121020931/https://www.perfect-privacy.com/en/blog/server-seizure-in-rotterdam", "source_type": "blog", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2017-11-06", "type": "other", "summary": "CVE-2017-16637: resetting network data during a live connection crashed a protection component of Perfect Privacy VPN Manager 1.10.10 and 1.10.11 for Windows. A local issue.", "evidence": "when resetting the network data via the software client, with a running VPN connection", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2017-16637", "source_type": "nvd", "verified_at": "2026-10-21" }, { "kind": "transparency", "period": "as of 2025-07-03", "requests": null, "canary_updated": "2025-07-03", "note": "Warrant canary (stale): no NSLs, warrants, court orders, backdoor requests or gag orders as of 3 Jul 2025, despite promised monthly updates. The site did not resolve on 21 Oct 2026; its current state is unknown.", "evidence": "As of Jul 3, 2025, we have received", "source_url": "https://web.archive.org/web/20251122133524/https://www.perfect-privacy.com/en/warrant-canary", "source_type": "html", "verified_at": "2026-10-21" } ] }, { "provider": "pia", "provider_name": "Private Internet Access", "page": "https://myipscan.net/vpn/pia-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "linux", "android" ], "status": "mitigated", "as_of": "2024-05-08", "fixed_in": "the kill switch, on by default", "note": "PIA says the kill switch, on by default, protects every platform except iOS; the exploit needs it switched off.", "evidence": "PIA's kill switch will protect you completely on all desktop and mobile platforms except iOS", "source_url": "https://www.privateinternetaccess.com/blog/pia-tunnelvision-security-response/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-08", "note": "PIA says iOS can be affected because Apple controls how traffic is routed there.", "evidence": "We want to highlight that iOS can be impacted", "source_url": "https://www.privateinternetaccess.com/blog/pia-tunnelvision-security-response/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No PIA statement found, and its changelog does not mention it.", "source_url": "https://www.privateinternetaccess.com/pages/changelog", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "note": "No PIA statement found, and its changelog does not mention it.", "source_url": "https://www.privateinternetaccess.com/pages/changelog", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "IP leak with split tunnelling in bypass mode", "platforms": [ "linux" ], "status": "fixed", "as_of": "2025-07-07", "fixed_in": "3.6.2", "note": "PIA's changelog: fixed a potential IP leak when split tunnelling runs in bypass mode.", "evidence": "Linux: Fixed potential IP leak when using split tunneling in bypass mode", "source_url": "https://www.privateinternetaccess.com/pages/changelog", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "3.8.0", "released": "2026-10-15", "evidence": "v3.8.0 Release Date: October 15, 2026", "source_url": "https://www.privateinternetaccess.com/pages/changelog", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2025-12-08", "scope_type": "no-logs", "scope": "Deloitte Audit Romania, ISAE 3000: server configuration as of 31 October 2025, including dedicated-IP tokens.", "public": true, "report_url": "https://assets-cms.privateinternetaccess.com/files/reports/CON-003_PIA_Report_ISAE_3000_(signed).pdf", "evidence": "Deloitte Audit Romania completed its third independent review of our VPN infrastructure", "source_url": "https://www.privateinternetaccess.com/blog/security-audit-2025/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2024-04-25", "scope_type": "no-logs", "scope": "Deloitte Audit Romania: servers, network and incident management, dedicated IP.", "public": false, "evidence": "we invited Deloitte Audit Romania to review our VPN server network and management systems", "source_url": "https://www.privateinternetaccess.com/blog/security-audit-2024/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2022-08-30", "scope_type": "no-logs", "scope": "Deloitte Audit Romania: server configuration as of 30 June 2022.", "public": false, "evidence": "The auditing firm found that server configurations align as of June 30, 2022", "source_url": "https://www.privateinternetaccess.com/blog/privacy-audit/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Apr-Jun 2026", "requests": 19, "note": "Subpoenas, warrants and foreign requests; PIA says it produced no logs.", "evidence": "Between April and June 2026, PIA received 19 legal requests.", "source_url": "https://www.privateinternetaccess.com/blog/transparency-report-q2-2026/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Private Internet Access, Inc.", "country": "United States", "parent": "Kape Technologies", "since": "2019", "note": "Kape lists the PIA acquisition as December 2019.", "evidence": "Private Internet Access, Inc. 2590 Welton St. Suite 200 Denver, CO 80205", "source_url": "https://www.privateinternetaccess.com/about-us", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "PIA says its servers are RAM-only.", "evidence": "Our no-logs commitment is built into our RAM-only server infrastructure", "source_url": "https://www.privateinternetaccess.com/vpn-features/no-logs-vpn", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Desktop, iOS and browser-extension clients are published on GitHub.", "repo_url": "https://github.com/pia-foss", "evidence": "Free and Open Source Software from Private Internet Access", "source_url": "https://github.com/pia-foss", "source_type": "github", "verified_at": "2026-10-19" } ] }, { "provider": "planet-vpn", "provider_name": "Planet VPN", "page": "https://myipscan.net/vpn/planet-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "FREE VPN PLANET S.R.L.", "country": "Romania", "evidence": "FREE VPN PLANET S.R.L. (hereafter referred to as", "source_url": "https://freevpnplanet.com/terms/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "audit", "status": "none_found", "note": "The no-logs page FAQ says the policy can be confirmed 'through independent audit' but names no auditor and links no report. The privacy policy (/policy/) mentions only internal 'Regular audits and continuous monitoring'. Homepage and /about-us were also checked.", "source_url": "https://freevpnplanet.com/no-logs-vpn-policy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Planet VPN claims diskless, RAM-based servers. The homepage separately mentions 'encrypted drives'. No independent verification is published.", "evidence": "All Planet VPN servers run on diskless, RAM-based infrastructure", "source_url": "https://freevpnplanet.com/no-logs-vpn-policy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "android", "ios", "browser" ], "status": "not_stated", "as_of": "2026-10-21", "note": "The homepage claims a built-in kill switch on Windows, macOS, Android, iOS and browsers. No TunnelVision or TunnelCrack statement was found.", "source_url": "https://freevpnplanet.com/", "source_type": "html", "verified_at": "2026-10-21" } ] }, { "provider": "privadovpn", "provider_name": "PrivadoVPN", "page": "https://myipscan.net/vpn/privadovpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in PrivadoVPN's version logs, support centre or blog.", "source_url": "https://blog.privadovpn.com/privadovpn-windows-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in PrivadoVPN's version logs, support centre or blog.", "source_url": "https://blog.privadovpn.com/privadovpn-windows-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found in PrivadoVPN's version logs, support centre or blog.", "source_url": "https://blog.privadovpn.com/privadovpn-windows-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "macOS IPv6 issue patched", "platforms": [ "macos" ], "status": "fixed", "as_of": "2022-09-22", "fixed_in": "macOS 3.1.0", "note": "The version log calls it an IPv6 issue and does not say whether traffic leaked.", "evidence": "Found and patched IPv6 issue", "source_url": "https://blog.privadovpn.com/privadovpn-macos-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "macOS Kill Switch failed after an Ethernet reboot", "platforms": [ "macos" ], "status": "fixed", "as_of": "2023-11-08", "fixed_in": "macOS 3.7.0", "note": "Kill Switch bug fix in the macOS version log.", "evidence": "Fixed KillSwitch with Ethernet reboot issue.", "source_url": "https://blog.privadovpn.com/privadovpn-macos-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "4.1.0", "released": "2026-05-19", "evidence": "2026-5-19 – Windows 4.1.0", "source_url": "https://blog.privadovpn.com/privadovpn-windows-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "4.2.0", "released": "2026-07-10", "evidence": "2026-7-10 – macOS 4.2.0", "source_url": "https://blog.privadovpn.com/privadovpn-macos-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "4.0.11", "released": "2026-04-21", "evidence": "Android 4.0.11", "source_url": "https://blog.privadovpn.com/privadovpn-android-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "3.12.3", "released": "2026-05-21", "evidence": "2026-5-21 – iOS 3.12.3", "source_url": "https://blog.privadovpn.com/privadovpn-ios-app-version-log/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Privado Networks ehf", "country": "Iceland", "note": "The terms name the Icelandic company.", "evidence": "Privado Networks ehf, a private limited company organized under the laws of Iceland", "source_url": "https://privadovpn.com/terms-of-service/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "status": "none_found", "note": "The about page, homepage and a blog search for 'audit' mention no independent audit.", "source_url": "https://privadovpn.com/about-us/", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "privatevpn", "provider_name": "PrivateVPN", "page": "https://myipscan.net/vpn/privatevpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found on privatevpn.com, its blog or its help centre.", "source_url": "https://privatevpn.com/blog/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found on privatevpn.com, its blog or its help centre.", "source_url": "https://privatevpn.com/blog/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "PrivateVPN Global AB", "country": "Sweden", "parent": "Miss Group (Miss Group Holdings Ltd)", "note": "The acquisition was announced 17 Jun 2022 in Miss Group's own release on its Cision newsroom. Miss Group's site says it is 'headquartered in Stockholm, Sweden' and lists privatevpn.com among its brands. Press (Private Equity Wire) reports Miss Group is backed by private equity investor Perwyn; this is not stated on Miss Group's site.", "evidence": "PrivateVPN Global AB, Reg. No. 559282-2182, Box 2128, SE-442 02 Ytterby, Sweden", "source_url": "https://privatevpn.com/privacy-policy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Checked the privacy policy (last updated 16 Oct 2023), /features/no-log-vpn/, /features/kill-switch/, /terms-of-use/ and /why-privatevpn/about-us/. The no-log claim is there, but no independent audit is named or published.", "source_url": "https://privatevpn.com/features/no-log-vpn/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-21", "note": "A kill switch is described generically, with no platforms named. No TunnelVision or TunnelCrack statement was found.", "source_url": "https://privatevpn.com/features/kill-switch/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2018-02-21", "type": "other", "summary": "CVE-2018-7311: the privileged helper in PrivateVPN 2.0.31 for macOS ran an openvpn binary the user could overwrite, which gave root (VerSprite advisory VS-2018-004).", "provider_response": "Per NVD, the vendor reportedly called the behaviour 'an acceptable part of their software'.", "evidence": "PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability.", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-7311", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "proton-vpn", "provider_name": "Proton VPN", "page": "https://myipscan.net/vpn/proton-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows" ], "status": "not_affected", "as_of": "2026-10-18", "undated": true, "note": "Proton says its Windows app is not vulnerable to TunnelVision.", "evidence": "our Windows app is not vulnerable to TunnelVision", "source_url": "https://protonvpn.com/support/tunnelvision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2026-10-18", "undated": true, "note": "Proton describes the Android app as resistant to TunnelVision.", "evidence": "broadly resistant to TunnelVision if you use Android, Windows, or enable the kill switch", "source_url": "https://protonvpn.com/support/tunnelvision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2026-10-18", "fixed_in": "the kill switch", "undated": true, "note": "Resistant only with the kill switch turned on; the page does not say whether it is on by default.", "evidence": "or enable the kill switch feature on Apple devices", "source_url": "https://protonvpn.com/support/tunnelvision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "linux" ], "status": "affected", "as_of": "2026-10-18", "undated": true, "note": "Proton names Linux as the exception. With WireGuard the app is not vulnerable; with other protocols it can be.", "evidence": "The exception is our Linux app, but there are still ways to mitigate the risk", "source_url": "https://protonvpn.com/support/tunnelvision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "5.1.8", "released": "2026-09-22", "evidence": "5.1.8 2026-09-22", "source_url": "https://github.com/ProtonVPN/win-app/releases/tag/v5.1.8", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "5.20.74.0", "released": "2026-10-14", "evidence": "5.20.74.0 2026-10-14", "source_url": "https://github.com/ProtonVPN/android-app/releases/tag/5.20.74.0", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Securitum", "published": "2025-09-19", "scope_type": "no-logs", "scope": "On-site no-logs audit in Zurich, August to September 2025.", "public": true, "report_url": "https://www.securitum.com/public-reports/securitum-protonvpn-nologs-2025.pdf", "evidence": "Proton VPN no-logs audit 2025", "source_url": "https://protonvpn.com/blog/no-logs-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Securitum", "published": "2024-07-12", "scope_type": "no-logs", "scope": "On-site no-logs audit in Geneva, July 2024.", "public": true, "report_url": "https://www.securitum.com/public-reports/securitum-protonvpn-nologs-2024.pdf", "evidence": "Proton VPN no-logs audit 2024", "source_url": "https://protonvpn.com/blog/no-logs-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Securitum", "published": "2023-05-01", "scope_type": "no-logs", "scope": "On-site no-logs audit in Zurich, April to May 2023.", "public": true, "report_url": "https://www.securitum.com/public-reports/securitum-protonvpn-nologs-2023.pdf", "evidence": "Proton VPN no-logs audit 2023", "source_url": "https://protonvpn.com/blog/no-logs-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Securitum", "published": "2022-04-22", "scope_type": "no-logs", "scope": "First no-logs audit.", "public": true, "evidence": "Proton VPN no-logs audit 2022", "source_url": "https://protonvpn.com/blog/no-logs-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Ruben Santamarta", "published": "2025-12-01", "scope_type": "apps", "scope": "Security audits of the apps by an independent researcher; the date is when Proton's article was updated.", "public": true, "evidence": "latest security audits by independent security researcher, Ruben Santamarta", "source_url": "https://protonvpn.com/blog/open-source/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Jan-Jun 2026", "requests": 47, "note": "Swiss court orders; Proton says it denied all of them. No canary, because of Swiss notification law.", "evidence": "Total orders: 47 Denied orders: 47", "source_url": "https://protonvpn.com/blog/transparency-report", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Proton AG", "country": "Switzerland", "parent": "Proton Foundation", "note": "A non-profit foundation is the main shareholder and supervises Proton AG.", "evidence": "The Services are operated by Proton AG", "source_url": "https://proton.me/legal/terms", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Proton says all Proton VPN apps are open source.", "repo_url": "https://github.com/ProtonVPN", "evidence": "All Proton VPN apps are now open source and audited", "source_url": "https://protonvpn.com/blog/open-source", "source_type": "blog", "verified_at": "2026-10-19" } ] }, { "provider": "psiphon", "provider_name": "Psiphon", "page": "https://myipscan.net/vpn/psiphon-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "The leak section of Psiphon's FAQ does not mention it.", "source_url": "https://psiphon.ca/en/faq.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "The leak section of Psiphon's FAQ does not mention it.", "source_url": "https://psiphon.ca/en/faq.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "The leak section of Psiphon's FAQ does not mention it.", "source_url": "https://psiphon.ca/en/faq.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "WebRTC leak in the iOS browser and legacy Windows app", "platforms": [ "ios", "windows" ], "status": "affected", "as_of": "2026-10-18", "undated": true, "note": "Applies to the standalone Psiphon Browser for iOS and to Psiphon 3 for Windows; Psiphon says it is not a concern for its full-device apps.", "evidence": "It is a known issue in the standalone Psiphon Browser for iOS", "source_url": "https://psiphon.ca/en/faq.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "v189", "released": "2026-08-13", "evidence": "v189", "source_url": "https://github.com/Psiphon-Inc/psiphon-windows/releases/tag/v189", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2024-05", "scope_type": "protocol", "scope": "White-box test of the Psiphon Tunnel Core code, April to May 2024; no critical findings, one high.", "public": true, "report_url": "https://cure53.de/pentest-report_psiphon_4.pdf", "evidence": "Pentest-Report Psiphon Tunnel Core Codebase", "source_url": "https://cure53.de/pentest-report_psiphon_4.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Psiphon Inc.", "country": "Canada", "note": "Started at the Citizen Lab, University of Toronto.", "evidence": "Psiphon Inc. is incorporated, headquartered in Toronto, Canada", "source_url": "https://psiphon.ca/en/about.html", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Psiphon has been open source since its first release.", "repo_url": "https://github.com/Psiphon-Inc", "evidence": "Psiphon has been open source since its first public release", "source_url": "https://psiphon.ca/en/about.html", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "purevpn", "provider_name": "PureVPN", "page": "https://myipscan.net/vpn/purevpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found on PureVPN's blog, trust center, disclosure policy or support site.", "source_url": "https://www.purevpn.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found on PureVPN's blog, trust center, disclosure policy or support site.", "source_url": "https://www.purevpn.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement found on PureVPN's blog, trust center, disclosure policy or support site.", "source_url": "https://www.purevpn.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Linux IPv6 leak and firewall rule reset", "platforms": [ "linux" ], "status": "affected", "as_of": "2025-09-19", "note": "Affects GUI 2.10.0 and CLI 2.0.1. A fix was planned for mid-October 2025; the Linux release notes list nothing after 2.10.0.", "evidence": "IPv6 traffic may leak after suspend or WiFi toggles while the app", "source_url": "https://www.purevpn.com/blog/security-advisory-linux-client-ipv6-leak-firewall-rule-reset/", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Linux IPv6 leak and firewall rule reset", "platforms": [ "windows", "macos", "android", "ios" ], "status": "not_affected", "as_of": "2025-09-19", "note": "The same advisory limits the issue to Linux.", "evidence": "Other platforms (Windows, macOS, Android, iOS) are not affected.", "source_url": "https://www.purevpn.com/blog/security-advisory-linux-client-ipv6-leak-firewall-rule-reset/", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Linux DNS leak reported in 2023", "platforms": [ "linux" ], "status": "fixed", "as_of": "2023-11-20", "fixed_in": "a Linux client patch, version not stated", "note": "PureVPN says it patched the DNS leak in its Linux client.", "evidence": "PureVPN promptly patched the vulnerability in their Linux client.", "source_url": "https://www.purevpn.com/blog/purevpn-analysis-enhancing-security/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "15.19.07", "released": "2026-08-25", "evidence": "Version 15.19.07", "source_url": "https://support.purevpn.com/en_US/windows-release-notes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "9.46.0", "released": "2026-08-07", "evidence": "Version 9.46.0", "source_url": "https://support.purevpn.com/en_US/mac-release-notes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "9.0.0", "released": "2026-08-19", "evidence": "Version 9.0.0", "source_url": "https://support.purevpn.com/en_US/android-release-notes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "9.71.0", "released": "2026-08-13", "evidence": "Version 9.71.0", "source_url": "https://support.purevpn.com/en_US/ios-release-notes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "2.10.0", "released": "2024-10-08", "evidence": "Version 2.10.0", "source_url": "https://support.purevpn.com/en_US/linux/linux-release-note", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "KPMG", "published": "2023-04-17", "scope_type": "no-logs", "scope": "KPMG Canada checked four no-log claims on 7 servers in 6 countries in February 2023; the letter says it was not a security or full privacy assessment.", "public": false, "evidence": "KPMG concludes that PureVPN was compliant to the four assessed privacy policy claims", "source_url": "https://www.purevpn.com/wp-content/uploads/2023/07/KPMG_PureVPN_TPA_Letter_2023-04-FINAL-2.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "GZ Systems Limited", "country": "British Virgin Islands", "note": "Trades as PureVPN.", "evidence": "The Services are owned and operated by GZ Systems Limited", "source_url": "https://www.purevpn.com/term", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "speedify", "provider_name": "Speedify", "page": "https://myipscan.net/vpn/speedify-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-09-21", "note": "No Speedify statement in its release notes from 12.x to 17.2.", "source_url": "https://speedify.com/blog/release-notes/introducing-speedify-17-2/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-09-21", "note": "No Speedify statement in its release notes from 12.x to 17.2.", "source_url": "https://speedify.com/blog/release-notes/introducing-speedify-17-2/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-09-21", "note": "No Speedify statement in its release notes from 12.x to 17.2.", "source_url": "https://speedify.com/blog/release-notes/introducing-speedify-17-2/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "WebRTC and FaceTime IP leak on iOS", "platforms": [ "ios" ], "status": "mitigated", "as_of": "2026-04-01", "fixed_in": "the IP Leak Protection setting in 16.5", "note": "A new setting forces those calls through the tunnel; it can be switched off.", "evidence": "adds IP Leak Protection that forces WebRTC and FaceTime calls through Speedify", "source_url": "https://speedify.com/blog/release-notes/introducing-speedify-16-5/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux", "android", "ios", "router" ], "version": "17.2", "released": "2026-09-21", "evidence": "released on 21 September 2026 for Android, iOS, macOS, Windows, Linux and OpenWrt", "source_url": "https://speedify.com/blog/release-notes/introducing-speedify-17-2/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Connectify, Inc.", "country": "United States", "note": "Philadelphia mailing address; the state of incorporation is not stated.", "evidence": "Connectify, Inc. 601 Spring Garden, 3rd floor Philadelphia, PA 19123", "source_url": "https://speedify.com/privacy-policy/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "surfshark", "provider_name": "Surfshark", "page": "https://myipscan.net/vpn/surfshark-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "linux", "android" ], "status": "not_affected", "as_of": "2026-06-05", "note": "Surfshark says these apps are immune: firewall rules stop traffic leaving the device outside the tunnel.", "evidence": "our Android, Linux, and Windows clients are immune due to firewall configurations", "source_url": "https://support.surfshark.com/hc/en-us/articles/36162255549074-What-should-you-know-about-Invisible-on-LAN-and-its-limitations", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2026-06-05", "fixed_in": "the Invisible on LAN setting", "note": "Apple platforms rely on the Invisible on LAN setting, and Surfshark lists Apple VPN bugs that can break connectivity while it is on.", "evidence": "To protect users from sophisticated network attacks, we provide the Invisible on LAN feature", "source_url": "https://support.surfshark.com/hc/en-us/articles/36162255549074-What-should-you-know-about-Invisible-on-LAN-and-its-limitations", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "windows", "linux", "android" ], "status": "not_affected", "as_of": "2026-06-05", "note": "Covered by the same article: the firewall keeps local-network tricks from pulling traffic out of the tunnel.", "evidence": "our Android, Linux, and Windows clients are immune due to firewall configurations", "source_url": "https://support.surfshark.com/hc/en-us/articles/36162255549074-What-should-you-know-about-Invisible-on-LAN-and-its-limitations", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "macos", "ios" ], "status": "mitigated", "as_of": "2026-06-05", "fixed_in": "the Invisible on LAN setting", "note": "Mitigated by Invisible on LAN, which limits local network access; it carries the same Apple bugs.", "evidence": "To protect users from sophisticated network attacks, we provide the Invisible on LAN feature", "source_url": "https://support.surfshark.com/hc/en-us/articles/36162255549074-What-should-you-know-about-Invisible-on-LAN-and-its-limitations", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-06-05", "note": "Surfshark's article on these attacks does not address ServerIP.", "source_url": "https://support.surfshark.com/hc/en-us/articles/36162255549074-What-should-you-know-about-Invisible-on-LAN-and-its-limitations", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2026-03", "scope_type": "protocol", "scope": "Architecture and cryptography of the Dausos protocol; only a summary is published.", "public": false, "evidence": "Cure53 carried out an independent audit of our infrastructure and new protocol Dausos", "source_url": "https://surfshark.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "SecuRing", "published": "2026-01-23", "scope_type": "infrastructure", "scope": "Black-box penetration test of the network infrastructure, 1 to 10 December 2025.", "findings": { "critical": 0, "medium": 1 }, "public": true, "report_url": "https://surfshark.com/media/SurfShark-InfrastructureTestReport_20251217_Public.pdf", "evidence": "Surfshark completed an infrastructure audit by SecuRing", "source_url": "https://surfshark.com/blog/surfshark-securing-infrastructure-audit", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "SecuRing", "published": "2025-06-09", "scope_type": "apps", "scope": "Web, desktop and mobile apps and extensions, February to April 2025; only an attestation letter is published.", "public": false, "evidence": "SecuRing conducted a security assessment.", "source_url": "https://surfshark.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2025-06-16", "scope_type": "no-logs", "scope": "ISAE 3000: standard, static and multiport servers and their deployment.", "public": false, "evidence": "This independent assurance, carried out by Deloitte, one of the Big Four auditing firms", "source_url": "https://surfshark.com/blog/deloitte-nologs-policy-verified-again", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2023-01-25", "scope_type": "no-logs", "scope": "Server configuration and deployment, API, network software and staff interviews.", "public": false, "evidence": "Deloitte, one of the Big Four auditing firms, has just performed independent assurance procedures", "source_url": "https://surfshark.com/blog/deloitte-audit-nologs", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2021-04", "scope_type": "infrastructure", "scope": "Servers, VPN configuration and related infrastructure; only a management summary is published.", "public": false, "evidence": "Cure53, a German company, thoroughly studied our infrastructure and found no significant concerns.", "source_url": "https://surfshark.com/trust-center", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Jul-Sep 2026", "requests": 23, "note": "Inquiries from government institutions; Surfshark replaced its warrant canary with this quarterly report.", "evidence": "Inquiries from government institutions 23", "source_url": "https://surfshark.com/transparency-report", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Surfshark B.V.", "country": "Netherlands", "parent": "Nord Security", "note": "Merged with Nord Security under one holding company in 2022; runs independently.", "evidence": "In 2022, Surfshark and Nord Security merged under one holding company", "source_url": "https://surfshark.com/about-us", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "Surfshark says its servers are RAM-only and wiped on every reboot.", "evidence": "We are among the first VPN providers to upgrade our servers to RAM-only infrastructure", "source_url": "https://surfshark.com/trust-center", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "tailscale", "provider_name": "Tailscale", "page": "https://myipscan.net/vpn/tailscale-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "linux" ], "status": "not_affected", "as_of": "2024-05-24", "note": "Tailscale's route management overrides the route a DHCP server pushes.", "evidence": "routing management overrides the DHCP-provided route, preventing the attack.", "source_url": "https://tailscale.com/blog/tunnelvision-analysis", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-24", "note": "Android's DHCP client does not implement option 121.", "evidence": "Tailscale on Android is not vulnerable.", "source_url": "https://tailscale.com/blog/tunnelvision-analysis", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows" ], "status": "affected", "as_of": "2024-05-24", "note": "Tailscale calls it partial: with an exit node on, packets to the pushed routes are dropped rather than leaked.", "evidence": "Tailscale on Windows is partially impacted by this issue.", "source_url": "https://tailscale.com/blog/tunnelvision-analysis", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos" ], "status": "mitigated", "as_of": "2024-06-12", "fixed_in": "v1.68, which detects option 121 routes and warns", "note": "Detection and a warning only; the pushed route itself is not overridden.", "evidence": "On macOS, as of v1.68 or later, the Tailscale client will detect", "source_url": "https://tailscale.com/blog/tunnelvision-analysis", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2025-10-29", "note": "No fix on iOS: the app cannot override option 121 routes there.", "evidence": "On macOS and iOS devices, Tailscale cannot override DHCP option 121.", "source_url": "https://tailscale.com/kb/1412/tunnel-vision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Not mentioned in Tailscale's security bulletins, blog or knowledge base.", "source_url": "https://tailscale.com/security-bulletins", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Not mentioned in Tailscale's security bulletins, blog or knowledge base.", "source_url": "https://tailscale.com/security-bulletins", "source_type": "advisory", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "all" ], "version": "1.104.1", "released": "2026-10-07", "evidence": "Tailscale v1.104.1", "source_url": "https://tailscale.com/changelog", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Tailscale US Inc.", "country": "United States", "note": "A Delaware corporation for accounts created from September 2024; older accounts are with the Canadian Tailscale Inc.", "evidence": "Tailscale US Inc., a Delaware corporation with registered address at", "source_url": "https://tailscale.com/terms", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "open_source_clients", "detail": "The core client daemon is open source on all platforms.", "repo_url": "https://github.com/tailscale/tailscale", "evidence": "The core client code for the Tailscale daemon used across all platforms is open source", "source_url": "https://tailscale.com/opensource", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "tunnelbear", "provider_name": "TunnelBear", "page": "https://myipscan.net/vpn/tunnelbear-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows" ], "status": "not_affected", "as_of": "2024-05-09", "note": "TunnelBear marks Windows as safe because of its built-in firewall rules.", "evidence": "Firewall rules prevent outbound traffic from being sent outside of the VPN tunnel.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "macos" ], "status": "affected", "as_of": "2024-05-09", "note": "TunnelBear said it was looking at firewall rules for macOS; we found no later update.", "evidence": "Mitigation is possible with firewall rules, however is currently not supported in TunnelBear.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "ios" ], "status": "affected", "as_of": "2024-05-09", "note": "No firewall fix is possible on iOS; TunnelBear says its VigilantBear setting helps.", "evidence": "It is not possible to mitigate with firewall rules at this time.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "android" ], "status": "not_affected", "as_of": "2024-05-09", "note": "Android does not support the DHCP option the attack relies on.", "evidence": "Android does not support the DHCP configuration that results in this vulnerability and is unaffected.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "browser" ], "status": "not_affected", "as_of": "2024-05-09", "note": "The browser extensions are proxies that act before the system routing table.", "evidence": "HTTP proxies protect browser traffic before it reaches the OS routing table and is unaffected.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-05-09", "note": "TunnelBear mentions TunnelCrack only as related research, with no status for its apps.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-05-09", "note": "TunnelBear mentions TunnelCrack only as related research, with no status for its apps.", "source_url": "https://www.tunnelbear.com/blog/tunnelvision-a-newly-identified-vpn-vulnerability/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Cure53", "published": "2025-11-24", "scope_type": "full", "scope": "Eighth annual white-box audit, October to November 2024: apps, backend and server configuration, public APIs and encryption.", "public": false, "evidence": "Cure53 found a total 10 vulnerabilities of medium severity or higher", "source_url": "https://www.tunnelbear.com/blog/tunnelbear-completes-8th-annual-independent-security-audit/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "2021-2023", "requests": 70, "note": "Government requests over three years; TunnelBear confirmed account existence twice in 2023 and gave no browsing data.", "evidence": "Since 2021, we have had a total of 70 government authority requests.", "source_url": "https://www.tunnelbear.com/blog/tunnelbear-transparency-report-for-2023/", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "TunnelBear", "parent": "McAfee", "since": "2018", "note": "The registration country is not stated; the company has offices in Toronto.", "evidence": "TunnelBear was acquired by McAfee in April 2018", "source_url": "https://www.tunnelbear.com/blog/tunnelbear-transparency-report/", "source_type": "blog", "verified_at": "2026-10-18" } ] }, { "provider": "turbo-vpn", "provider_name": "Turbo VPN", "page": "https://myipscan.net/vpn/turbo-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Innovative Connecting Pte. Limited", "country": "Singapore", "parent": "Lemon Seed Technology Ltd. (Cayman Islands), named in Singapore corporate records as sole shareholder; TTP says Qihoo 360 acquired Lemon Seed in 2019", "note": "The policy gives the address as 8 Marina View #43-052A, Asia Square Tower 1, Singapore 018960, UEN 201812738K. The about page (https://turbovpn.com/aboutus) says the service was 'established in Singapore in 2018'. TTP (press/NGO; Turbo VPN itself says nothing about its parent) also writes 'This shows Qihoo 360 acquired the owner of Innovative Connecting'. Qihoo 360 reported selling 'Project L' to external parties in Sept 2020, but March 2025 filings for Lemon Seed and Innovative Connecting list the same director. Treat the current Qihoo link as TTP's assessment. The policy also says 'other third parties (our data partners) may be controllers of your information'.", "evidence": "Innovative Connecting Pte. Limited", "source_url": "https://turbovpn.com/policy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Checked the privacy policy (/policy), about page (/aboutus), /features/no-logs and /features/automatic-kill-switch on turbovpn.com. None mentions an independent audit, auditor or report. The no-logs page only asserts 'Turbo VPN does not and will never track or collect any information'.", "source_url": "https://turbovpn.com/features/no-logs", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-21", "note": "No statement on TunnelVision (CVE-2024-3661) or TunnelCrack was found on turbovpn.com. The only documented leak behaviour is an automatic kill switch. The page does not say which of its platforms (Android, iOS, Windows, macOS, Chrome) have it.", "source_url": "https://turbovpn.com/features/automatic-kill-switch", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2025-09-04", "type": "other", "summary": "Citizen Lab and Arizona State University researchers grouped 8 VPN apps from Innovative Connecting, Autumn Breeze and Lemon Clove: a shared hard-coded Shadowsocks key lets an eavesdropper decrypt traffic.", "provider_response": "No response from Innovative Connecting / Turbo VPN found on turbovpn.com.", "evidence": "eight VPN applications linked to providers Innovative Connecting, Autumn Breeze, and Lemon Clove", "source_url": "https://www.malwarebytes.com/blog/news/2025/09/popular-android-vpn-apps-found-to-have-security-flaws-and-china-links", "source_type": "blog", "verified_at": "2026-10-21" } ] }, { "provider": "twingate", "provider_name": "Twingate", "page": "https://myipscan.net/vpn/twingate-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "A Twingate glossary post describes TunnelVision but gives no status for its own clients.", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement for Twingate's own clients.", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No statement for Twingate's own clients.", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "2026.280", "released": "2026-10-09", "evidence": "Windows 2026.280", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "2026.279", "released": "2026-10-09", "evidence": "macOS 2026.279", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "2026.279", "released": "2026-10-13", "evidence": "iOS 2026.279 Oct 13, 2026", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "linux" ], "version": "2026.239", "released": "2026-10-06", "evidence": "Linux 2026.239 Oct 6, 2026", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "2026.237", "released": "2026-09-02", "evidence": "Android 2026.237 Sep 2, 2026", "source_url": "https://www.twingate.com/changelog/clients", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Twingate Inc.", "country": "United States", "note": "A Delaware corporation.", "evidence": "means Twingate Inc., a Delaware corporation", "source_url": "https://www.twingate.com/terms", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "urban-vpn", "provider_name": "Urban VPN", "page": "https://myipscan.net/vpn/urban-vpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Urban Cyber Security Inc.", "country": "United States", "parent": "BIScience (B.I. Science), a data broker", "note": "The policy (last updated 4 Sept 2026) names Urban Cyber Security Inc., registered number 10158667, 1007 N Orange St FL 83, Wilmington, DE 19801, as controller. Urban's own policy confirms an unnamed parent: 'Please be aware that our parent company is a data broker'. It also says 'We sell marketing insights and behavior segments' built from Web Browsing Data. The parent's name comes only from independent researcher Wladimir Palant and from The Register ('affiliated company BiScience').", "evidence": "Urban Cyber Security Inc. registered number 10158667", "source_url": "https://www.urban-vpn.com/about-us/privacy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "Checked the main privacy policy (/about-us/privacy/, updated 2026-09-04), /about-us/, /about-us/why-free/ and /features/kill-switch/. None mentions an independent security or no-logs audit. The 'Compliance Overview' PDF linked in the footer was not read.", "source_url": "https://www.urban-vpn.com/about-us/privacy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-21", "note": "No statement on TunnelVision or TunnelCrack was found. Urban's kill-switch page says the kill switch is currently mobile-only, with desktop 'coming soon'.", "source_url": "https://www.urban-vpn.com/features/kill-switch/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2025-12-15", "type": "other", "summary": "Koi Security reported that the Urban VPN Proxy extension and other Urban extensions capture prompts and replies on ten AI chat sites and send them to Urban's analytics servers, on by default.", "provider_response": "The Register's emails to Urban VPN and BiScience bounced. Urban's current privacy policy (updated 2026-09-04) discloses collecting 'AI Inputs and Outputs' and sharing de-identified, aggregated versions with business customers.", "evidence": "harvesting the text of chatbot conversations from more than 8 million people", "source_url": "https://www.theregister.com/software/2025/12/16/chrome-edge-privacy-extensions-quietly-snarf-ai-chats/2598347", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2025-01-13", "type": "other", "summary": "Researcher Wladimir Palant documented that Urban VPN and other Urban extensions collect browsing history, which BIScience sells through Clickstream OS and AdClarity.", "evidence": "Urban collects user browsing history from these services, which is then sold by BIScience", "source_url": "https://palant.info/2025/01/13/biscience-collecting-browsing-history-under-false-pretenses/", "source_type": "blog", "verified_at": "2026-10-21" } ] }, { "provider": "vpn-unlimited", "provider_name": "VPN Unlimited", "page": "https://myipscan.net/vpn/vpn-unlimited-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No KeepSolid statement found on vpnunlimited.com or its blog.", "source_url": "https://www.vpnunlimited.com/blog", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No KeepSolid statement found on vpnunlimited.com or its blog.", "source_url": "https://www.vpnunlimited.com/blog", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Windows Kill Switch let P2P clients leak the real IP", "platforms": [ "windows" ], "status": "fixed", "as_of": "2022-10-03", "fixed_in": "the Windows Kill Switch update of October 2022", "note": "Firewall rules rebuilt so P2P clients that bind to any interface cannot reach the internet outside the tunnel. The Kill Switch is off by default.", "evidence": "advanced P2P file-sharing clients that can use any network interface like qBittorent", "source_url": "https://www.vpnunlimited.com/blog/kill-switch-september-update-on-windows", "source_type": "blog", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "KeepSolid Inc.", "country": "United States", "note": "Registered address: 347 5th Ave, Suite 1402-419, New York, NY 10016. The company history (https://www.keepsolid.com/history) says 'Established in 2013' and 'Most of KeepSolid's employees live in Ukraine'. No parent company is named on keepsolid.com.", "evidence": "KeepSolid Inc., 347 5th Ave, Suite 1402-419, New York, NY 10016, USA", "source_url": "https://www.keepsolid.com/privacy-policy", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "The no-log page says 'proven no-logs policy' and 'regular audits' but names no auditor and links no report. Also checked the KeepSolid privacy policy, about page and history page: no independent audit is listed. The 2018 VerSprite finding (see incident) was independent vulnerability research, not a commissioned audit.", "source_url": "https://www.vpnunlimited.com/help/more-about-vpn/best-no-log-vpn", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2024-12-05", "note": "KeepSolid ships a 'Tunnel Vision Checker' that detects and alerts when traffic bypasses the tunnel (blog dated 5 Dec 2024). The post does not name CVE-2024-3661 or DHCP option 121, does not claim to block the attack, and does not list platforms. No TunnelCrack statement was found.", "source_url": "https://www.vpnunlimited.com/blog/advanced-networking-features-explained", "source_type": "blog", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2018-03-16", "type": "other", "summary": "CVE-2018-8739: the macOS client's privileged helper let any local app run commands as root. NVD names version 4.2.0; VerSprite's advisory VS-2018-014 says versions before 4.2.0.", "provider_response": "The VerSprite advisory records the vendor response as 'VPN Unlimited team is reviewing.'", "evidence": "VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2018-8739", "source_type": "nvd", "verified_at": "2026-10-21" }, { "kind": "incident", "date": "2026-02-03", "type": "other", "summary": "CVE-2020-37101: VPN Unlimited 6.1 for Windows installs its service under an unquoted path, allowing local privilege escalation. Found in 2020; NVD published it in February 2026.", "evidence": "VPN Unlimited 6.1 contains an unquoted service path vulnerability", "source_url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2020-37101", "source_type": "nvd", "verified_at": "2026-10-21" } ] }, { "provider": "vyprvpn", "provider_name": "VyprVPN", "page": "https://myipscan.net/vpn/vyprvpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "windows", "macos", "android", "ios" ], "status": "not_affected", "as_of": "2024-05-15", "note": "VyprVPN says a check at connect time fails the connection if traffic would not go through the tunnel.", "evidence": "Whenever you connect using the VyprVPN app, you are protected from TunnelVision", "source_url": "https://support.vyprvpn.com/hc/en-us/articles/26749654912013-What-is-TunnelVision", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Not mentioned in VyprVPN's changelogs, blog or support centre.", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "Not mentioned in VyprVPN's changelogs, blog or support centre.", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows" ], "version": "6.0.4", "released": "2025-12-15", "evidence": "6.0.4 December 15, 2025", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-windows", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "macos" ], "version": "6.0.4", "released": "2025-12-15", "evidence": "6.0.4 December 15, 2025", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-mac", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "6.1.0", "released": "2026-05-18", "evidence": "6.1.0 May 18, 2026", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-android", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "6.1.0", "released": "2026-05-18", "evidence": "6.1.0 May 18, 2026", "source_url": "https://www.vyprvpn.com/resources/changelog/vyprvpn-changelog-ios", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2018-11-09", "scope_type": "no-logs", "scope": "No-log assessment of VyprVPN, final report with retest, prepared for Golden Frog", "public": true, "report_url": "https://www.vyprvpn.com/audit.pdf", "evidence": "Read the full report here: VyprVPN Letter of Attestation and No Log Assessment by Leviathan", "source_url": "https://www.vyprvpn.com/our-commitment", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "owner", "entity": "Certida LLC", "country": "United States", "evidence": "Proudly made by Certida", "source_url": "https://www.vyprvpn.com/our-commitment", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "windscribe", "provider_name": "Windscribe", "page": "https://myipscan.net/vpn/windscribe-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-04-08", "note": "Windscribe's firewall article does not mention TunnelVision, and no other statement was found.", "source_url": "https://windscribe.com/knowledge-base/articles/firewall-modes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-04-08", "note": "No Windscribe statement found on its site or in its app releases.", "source_url": "https://windscribe.com/knowledge-base/articles/firewall-modes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-04-08", "note": "No Windscribe statement found on its site or in its app releases.", "source_url": "https://windscribe.com/knowledge-base/articles/firewall-modes", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "Linux IPv6 DNS leak protection gap", "platforms": [ "linux" ], "status": "fixed", "as_of": "2026-07-06", "fixed_in": "2.23.11", "note": "IPv6 DNS servers were missing from the leak protection rules.", "evidence": "Linux IPv6 DNS leak protection missing ip6tables rules for IPv6 DNS resolvers.", "source_url": "https://github.com/Windscribe/Desktop-App/releases/tag/v2.23.11", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "DNS leak on Linux with resolvectl", "platforms": [ "linux" ], "status": "fixed", "as_of": "2025-09-30", "fixed_in": "2.17.9", "note": "From Windscribe's desktop release notes.", "evidence": "DNS may leak on Linux distros using resolvectl to determine the system DNS.", "source_url": "https://github.com/Windscribe/Desktop-App/releases/tag/v2.17.9", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "incident", "title": "IPv6 leak with WireGuard and Allow LAN", "platforms": [ "android" ], "status": "fixed", "as_of": "2023-07-09", "fixed_in": "3.74", "note": "From Windscribe's Android release notes.", "evidence": "Wireguard + allowLan ipv6 leak fix.", "source_url": "https://github.com/Windscribe/Android-App/releases/tag/v3.74", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "2.24.13", "released": "2026-09-08", "evidence": "v2.24.13", "source_url": "https://github.com/Windscribe/Desktop-App/releases/tag/v2.24.13", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "android" ], "version": "4.3", "released": "2026-09-01", "evidence": "v4.3", "source_url": "https://github.com/Windscribe/Android-App/releases/tag/v4.3", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "ios" ], "version": "3.14.1", "released": "2026-08-25", "evidence": "v3.14.1", "source_url": "https://github.com/Windscribe/iOS-App/releases/tag/v3.14.1", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Packetlabs", "published": "2024-06", "scope_type": "infrastructure", "scope": "The FreshScribe VPN server stack.", "public": true, "evidence": "FreshScribe has been audited by Packetlabs in June 2024 with a very positive outcome.", "source_url": "https://windscribe.com/knowledge-base/articles/has-windscribe-been-audited", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2022-03", "scope_type": "apps", "scope": "Source review of the Android and iOS apps; Windscribe says all issues were fixed.", "public": true, "report_url": "https://github.com/Windscribe/Android-App/files/11266292/Windscribe.Limited.-.2022.-.VPN.Source.Code.Review.Final.Report.pdf", "evidence": "undergone an audit by Leviathan Security Group in March 2022", "source_url": "https://windscribe.com/knowledge-base/articles/has-windscribe-been-audited", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Leviathan Security", "published": "2021-09", "scope_type": "apps", "scope": "Code review of the desktop client.", "public": true, "report_url": "https://github.com/Windscribe/Desktop-App/files/11266277/Windscribe.Limited.-.Client.Application.Code.Review.Final.Report.pdf", "evidence": "The Windscribe desktop application was audited in September 2021 by Leviathan Security Group.", "source_url": "https://windscribe.com/knowledge-base/articles/has-windscribe-been-audited", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "live monthly report", "note": "Counts load in the browser; Windscribe states it complied with no requests because it had no relevant data.", "evidence": "Exactly zero requests were complied with due to lack of relevant data.", "source_url": "https://windscribe.com/transparency", "source_type": "html", "requests": null, "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "Windscribe Limited", "country": "Canada", "note": "An Ontario company with a Toronto address.", "evidence": "a company registered in the province of Ontario, Canada", "source_url": "https://windscribe.com/terms", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "incident", "date": "2021-06-24", "type": "server_seizure", "summary": "Ukrainian authorities seized two Windscribe servers whose unencrypted disks held an OpenVPN server certificate and key.", "provider_response": "Windscribe replaced its OpenVPN certificate authority and moved servers to in-memory operation.", "evidence": "our monitoring systems alerted us that two servers in Ukraine had gone offline", "source_url": "https://windscribe.com/blog/openvpn-security-improvements-and-changes-7b04ea49222", "source_type": "blog", "verified_at": "2026-10-19" }, { "kind": "incident", "date": "2025-04-11", "type": "logs_tested", "summary": "A court in Athens dismissed criminal charges against Windscribe's founder over activity by an unknown user of a Windscribe server.", "provider_response": "Windscribe said it keeps no user activity logs, so there was nothing to hand over.", "evidence": "The charges against Sak were formally dismissed on April 11, 2025.", "source_url": "https://cybernewswire.com/court-dismisses-criminal-charges-against-vpn-executive-affirms-no-log-policy/", "source_type": "html", "verified_at": "2026-10-19" }, { "kind": "infra", "feature": "open_source_clients", "detail": "Windscribe says all its apps are open source.", "repo_url": "https://github.com/windscribe", "evidence": "All our apps are open-source, so you can see how everything works", "source_url": "https://windscribe.com/about", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "x-vpn", "provider_name": "X-VPN", "page": "https://myipscan.net/vpn/x-vpn-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "X-VPN publishes security statements under /resources/statement-*; none covers TunnelVision.", "source_url": "https://xvpn.io/resources/statement-on-blind-in-on-path-attacks", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "None of X-VPN's security statements covers TunnelCrack.", "source_url": "https://xvpn.io/resources/statement-on-blind-in-on-path-attacks", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "None of X-VPN's security statements covers TunnelCrack.", "source_url": "https://xvpn.io/resources/statement-on-blind-in-on-path-attacks", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Deloitte", "published": "2026-04-30", "scope_type": "no-logs", "scope": "Deloitte Singapore, ISAE 3000 limited assurance on configuration and operations against the no-logs statements, as of 28 February 2026; two observations reported fixed.", "public": true, "report_url": "https://xvpn.io/assets/LightningLink-ISAE-3000-Report.pdf", "evidence": "Limited Assurance Report on X-VPN Services as of 28 February 2026", "source_url": "https://xvpn.io/assets/LightningLink-ISAE-3000-Report.pdf", "source_type": "pdf", "verified_at": "2026-10-18" }, { "kind": "transparency", "period": "Q2 2026", "requests": 6, "note": "Law enforcement requests, plus DMCA notices; X-VPN reports providing no data.", "evidence": "none resulted in data disclosure", "source_url": "https://xvpn.io/transparency-report", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "LightningLink Networks Pte. Ltd.", "country": "Singapore", "note": "Named in X-VPN's policy page.", "evidence": "LIGHTNINGLINK NETWORKS PTE. LTD. is dedicated to creating a free and secure online environment", "source_url": "https://xvpn.io/policy", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "infra", "feature": "ram_only_servers", "detail": "X-VPN says its servers are RAM-only, with no hard drives.", "evidence": "Our RAM-only servers are physically incapable of storing persistent data.", "source_url": "https://xvpn.io/features/ram-only-servers", "source_type": "html", "verified_at": "2026-10-19" } ] }, { "provider": "zerotier", "provider_name": "ZeroTier", "page": "https://myipscan.net/vpn/zerotier-leak-test/", "facts": [ { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No ZeroTier statement or CVE on it.", "source_url": "https://docs.zerotier.com/security/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-localnet", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No ZeroTier statement or CVE on it.", "source_url": "https://docs.zerotier.com/security/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "leak_issue", "issue": "tunnelcrack-serverip", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-18", "undated": true, "note": "No ZeroTier statement or CVE on it.", "source_url": "https://docs.zerotier.com/security/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "client_version", "platforms": [ "windows", "macos", "linux" ], "version": "1.16.2", "released": "2026-05-20", "evidence": "2026-05-20 -- Version 1.16.2", "source_url": "https://raw.githubusercontent.com/zerotier/ZeroTierOne/dev/RELEASE-NOTES.md", "source_type": "github", "verified_at": "2026-10-18" }, { "kind": "audit", "auditor": "Trail of Bits", "published": "2020-03-23", "scope_type": "protocol", "scope": "One-week review of the ZeroTier 2.0 cryptographic design; a preliminary review, not a code audit.", "public": true, "report_url": "https://storage.googleapis.com/zt-web-large-files/ZeroTier%20Protocol%20Review%20Summary.pdf", "evidence": "In March 2020 we worked with @trailofbits to audit our protocol and cryptographic designs", "source_url": "https://docs.zerotier.com/security/", "source_type": "html", "verified_at": "2026-10-18" }, { "kind": "owner", "entity": "ZeroTier, Inc.", "country": "United States", "note": "San Francisco address; EU representative in Utrecht.", "evidence": "Owner and Data Controller ZeroTier, Inc. 548 Market St", "source_url": "https://www.zerotier.com/privacy-policy/", "source_type": "html", "verified_at": "2026-10-18" } ] }, { "provider": "zoogvpn", "provider_name": "ZoogVPN", "page": "https://myipscan.net/vpn/zoogvpn-leak-test/", "facts": [ { "kind": "owner", "entity": "Zoog Services Single Member Private Company (Zoog Services IKE / PC)", "country": "Greece", "note": "The privacy policy says it is 'a company incorporated in Greece' with registered office at 130 Germanou Str, 26224 Patras. The about page (https://zoogvpn.com/about/) says 'ZoogVPN was founded in May 2013'. No parent company is stated.", "evidence": "Zoog Services Single Member Private Company", "source_url": "https://zoogvpn.com/privacy/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "audit", "status": "none_found", "note": "No published independent audit report was found. Checked /privacy/, /about/, /features/no-logs-vpn/, /features/kill-switch/ and /warrant-canary/. The only audit claim is a third-party review (SafeSurf Hub) quoted on zoogvpn.com: the Android app got a Google Play 'Verified' badge after an independent audit in January 2026 ('the audit applies only to Android'). The assessing lab and any report are not named, so no auditor can be recorded.", "source_url": "https://zoogvpn.com/zoogvpn-review-by-safesurf/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "leak_issue", "issue": "tunnelvision", "platforms": [ "all" ], "status": "not_stated", "as_of": "2026-10-21", "note": "No statement on TunnelVision or TunnelCrack was found on zoogvpn.com. Documented leak behaviour: a kill switch on Android, iOS, Windows and macOS (not Linux or router), and DNS leak protection in its apps (/features/leak-protection/).", "source_url": "https://zoogvpn.com/features/kill-switch/", "source_type": "html", "verified_at": "2026-10-21" }, { "kind": "transparency", "period": "through October 2026", "canary_updated": "2026-10-02", "note": "Warrant canary, October 2026: 0 National Security Letters, 0 gag orders, 0 government warrants or subpoenas. Other kinds of request are not counted.", "evidence": "As of October 2026 ZoogVPN has received:", "source_url": "https://zoogvpn.com/warrant-canary/", "source_type": "html", "verified_at": "2026-10-21", "requests": null } ] } ] }