Sourced tracker
Which VPN apps are affected by TunnelVision and TunnelCrack
39 VPN providers, app by app, against the two leak attacks that matter most on public Wi-Fi. Every status comes from the provider’s own statement or changelog, every row links to it, and every source is re-read weekly. A dash means the provider has said nothing about that app. Last checked 18 Oct 2026.
The attacks
TunnelVision
CVE-2024-3661 · disclosed 6 May 2024
A rogue DHCP server pushes routes (option 121) that pull traffic out of the tunnel while the VPN still shows connected. Original research.
TunnelCrack LocalNet
CVE-2023-36672, CVE-2023-35838 · disclosed 8 Aug 2023
A rogue Wi-Fi network assigns itself public addresses the VPN treats as local, so traffic to them skips the tunnel. Original research.
TunnelCrack ServerIP
CVE-2023-36673, CVE-2023-36671 · disclosed 8 Aug 2023
A spoofed DNS answer for the VPN server makes the client route chosen traffic outside the tunnel. Original research.
TunnelVision CVE-2024-3661
| Provider | Windows | macOS | Linux | Android | iOS | Source |
|---|---|---|---|---|---|---|
| AdGuard VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Astrill | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Bitdefender VPN | Not affected | Mitigated | — | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| Brave VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| CyberGhost | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Edge Secure Network | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ExpressVPN | Mitigated | Mitigated | Mitigated | Not affected | Affected | SourceRead 18 Oct 2026 |
| F-Secure VPN | Not affected | Not affected | — | Not affected | Affected | SourceRead 18 Oct 2026 |
| hide.me | Mitigated | Mitigated | Mitigated | Not affected | Affected | SourceRead 18 Oct 2026 |
| Hotspot Shield | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| iCloud Private Relay | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| IVPN | Mitigated | Mitigated | Mitigated | Not affected | Affected | SourceSource 2Read 18 Oct 2026 |
| Mozilla VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Mullvad | Not affected | Not affected | Not affected | Not affected | Affected | SourceRead 18 Oct 2026 |
| NetBird | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordLayer | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordVPN | Not affected | Mitigated | Not affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| Norton VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Opera VPN | Not affectedbrowser VPN | Not affectedbrowser VPN | Not affectedbrowser VPN | Not affectedbrowser VPN | Not stated | SourceRead 18 Oct 2026 |
| OVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PrivadoVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Private Internet Access | Mitigated | Mitigated | Mitigated | Mitigated | Affected | SourceRead 18 Oct 2026 |
| PrivateVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Proton VPN | Not affected | Mitigated | Affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| Psiphon | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PureVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Speedify | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Surfshark | Not affected | Mitigated | Not affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| Tailscale | Affected | Mitigated | Not affected | Not affected | Affected | SourceSource 2Read 18 Oct 2026 |
| TunnelBear | Not affectedbrowser VPN | Not affectedbrowser VPN | Not affectedbrowser VPN | Not affectedbrowser VPN | Affected | SourceRead 18 Oct 2026 |
| Twingate | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VPN Unlimited | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VyprVPN | Not affected | Not affected | — | Not affected | Not affected | SourceRead 18 Oct 2026 |
| Windscribe | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| X-VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ZeroTier | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
TunnelCrack LocalNet CVE-2023-36672, CVE-2023-35838
| Provider | Windows | macOS | Linux | Android | iOS | Source |
|---|---|---|---|---|---|---|
| AdGuard VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Astrill | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Bitdefender VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Brave VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Cloudflare WARP | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| CyberGhost | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Edge Secure Network | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ExpressVPN | Not affected | Not affected | Not affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| F-Secure VPN | Fixed | Fixed | Fixed | Fixed | Fixed | SourceRead 18 Oct 2026 |
| hide.me | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Hotspot Shield | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| iCloud Private Relay | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| IVPN | Fixed | Fixed | Fixed | Fixed | Mitigated | SourceRead 18 Oct 2026 |
| Mullvad | Not affected | Not affected | Not affected | Not affected | Mitigated | SourceSource 2Read 18 Oct 2026 |
| NetBird | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordLayer | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordVPN | Not affected | Mitigated | Not affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| OVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PrivadoVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Private Internet Access | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PrivateVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Psiphon | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PureVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Speedify | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Surfshark | Not affected | Mitigated | Not affected | Not affected | Mitigated | SourceRead 18 Oct 2026 |
| Tailscale | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| TunnelBear | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Twingate | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VPN Unlimited | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VyprVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Windscribe | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| X-VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ZeroTier | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
TunnelCrack ServerIP CVE-2023-36673, CVE-2023-36671
| Provider | Windows | macOS | Linux | Android | iOS | Source |
|---|---|---|---|---|---|---|
| AdGuard VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Astrill | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Bitdefender VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Brave VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Cloudflare WARP | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| CyberGhost | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Edge Secure Network | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ExpressVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| F-Secure VPN | Fixed | Fixed | Fixed | Fixed | Fixed | SourceRead 18 Oct 2026 |
| hide.me | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Hotspot Shield | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| iCloud Private Relay | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| IVPN | Not affected | Not affected | Not affected | Fixed | Not affected | SourceRead 18 Oct 2026 |
| Mullvad | Not affected | Not affected | Not affected | Not affected | Not affected | SourceRead 18 Oct 2026 |
| NetBird | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordLayer | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| NordVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| OVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PrivadoVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Private Internet Access | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PrivateVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Psiphon | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| PureVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Speedify | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Surfshark | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Tailscale | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| TunnelBear | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Twingate | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VPN Unlimited | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| VyprVPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| Windscribe | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| X-VPN | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
| ZeroTier | Not stated | Not stated | Not stated | Not stated | Not stated | SourceRead 18 Oct 2026 |
Leak bugs providers disclosed in their own apps
| Provider | Issue | Apps | Status | What the provider said | Source |
|---|---|---|---|---|---|
| AdGuard VPN | DNS requests leaked | Windows | FixedFix: 2.8 | From AdGuard VPN's Windows release notes. | adguard-vpn.comStated 18 Dec 2025 |
| AdGuard VPN | IP leak on network loss, and DNS leaks | Linux | FixedFix: 1.1 | The same Linux release also fixed DNS leaks while connected. | adguard-vpn.comStated 10 Oct 2024 |
| AdGuard VPN | Kill Switch failed when DNS was lost | macOS | FixedFix: 2.1.1 | From AdGuard VPN's macOS release notes. | adguard-vpn.comStated 14 Aug 2023 |
| AirVPN | Windows DNS leak across physical adapters | Windows | FixedFix: Eddie 2.27.0 | From the changelog of Eddie, AirVPN's client. | eddie.websiteStated 1 Sep 2026 |
| Avast SecureLine VPN | Windows DNS leak through multi-homed name resolution | Windows | MitigatedFix: Avast Antivirus installed, or a Windows policy setting | Avast says its antivirus blocks the leak on IPv4 only; without it, a Windows policy setting has to be changed. | support.avast.comStated 7 Oct 2026 |
| Cloudflare WARP | CVE-2023-2754: Windows DNS sent to a local IPv6 address | Windows | FixedFix: 2023.7.160.0 | On IPv6 networks the client set DNS servers that a rogue host on the same Wi-Fi could answer, so it could see DNS queries. | github.comStated 3 Aug 2023 |
| ExpressVPN | RDP traffic outside the tunnel | Windows | FixedFix: 12.101.0.45 | Debug code in versions 12.97 to 12.101.0.2-beta let RDP and other port 3389 traffic bypass the tunnel. Reported 25 April 2025, fixed five days later. | expressvpn.comStated 18 Jul 2025 |
| iCloud Private Relay | CVE-2022-46716: Private Relay did not match settings | iOS, macOS | FixedFix: iOS 16.2, macOS Ventura 13.1 | Private Relay could behave differently from what the system settings showed. Entry added to Apple's notes on 16 March 2023. | support.apple.comStated 16 Mar 2023 |
| iCloud Private Relay | CVE-2023-40385: DNS queries leaked in WebKit | iOS, macOS, Browser | FixedFix: iOS 17, macOS Sonoma 14, Safari 17 | DNS queries could be seen with Private Relay turned on. | support.apple.comStated 22 Dec 2023 |
| iCloud Private Relay | CVE-2024-44246: Reading List revealed the IP address | iOS, macOS, Browser | FixedFix: iOS 18.2, macOS Sequoia 15.2, Safari 18.2 | Adding a site to the Safari Reading List could bypass Private Relay. | support.apple.comStated 11 Dec 2024 |
| iCloud Private Relay | CVE-2025-43276: Private Relay off with several users logged in | macOS | FixedFix: macOS Sequoia 15.6 | Private Relay could fail to switch on when more than one user was logged in. | support.apple.comStated 29 Jul 2025 |
| iCloud Private Relay | CVE-2025-43376: DNS queries leaked in WebKit | iOS, macOS, Browser | FixedFix: iOS 26, macOS Tahoe 26, Safari 26 | DNS queries could be seen with Private Relay turned on. Entry added 3 November 2025. | support.apple.comStated 3 Nov 2025 |
| iCloud Private Relay | CVE-2026-65355 and CVE-2026-65352: IP address disclosed | iOS, macOS | FixedFix: iOS 26.6.1, macOS Tahoe 26.6.2 | Issues in Authentication Services and WebKit let a site learn the user's IP address with Private Relay on. | support.apple.comStated 14 Sep 2026 |
| IVPN | Windows DNS leak, firewall rules hardened | Windows | FixedFix: 3.15.0 | From IVPN's desktop changelog. | raw.githubusercontent.comStated 4 Dec 2025 |
| IVPN | DNS leak during WireGuard key rotation | iOS | FixedFix: 2.12.5 | From IVPN's iOS changelog. | raw.githubusercontent.comStated 19 Feb 2025 |
| IVPN | DNS leak through link-local IPv6 addresses | Linux | FixedFix: 3.9.0 | From IVPN's desktop changelog. | raw.githubusercontent.comStated 21 Jul 2022 |
| Mozilla VPN | Captive-portal check ran outside the tunnel | Windows, macOS, Linux, Android, iOS | FixedFix: the fixes after the 2023 Cure53 audit, version not named | Found in Mozilla's 2023 audit: the captive-portal check no longer runs outside the VPN tunnel. | blog.mozilla.orgStated 6 Dec 2023 |
| Norton VPN | Real IP shown on IPv6-only networks | All | MitigatedFix: turning IPv6 off on the device | Norton says its VPN works over IPv4 only, so on an IPv6 network the real address can show. | support.norton.comStated 1 Sep 2026 |
| OVPN | IP leak with the always-on kill switch | Windows, macOS, Linux | FixedFix: 2.2.1 | From OVPN's desktop client release post. | ovpn.comStated 16 Aug 2022 |
| OVPN | DNS leak on Fedora | Linux | FixedFix: 2.4 | From OVPN's desktop client release post. | ovpn.comStated 10 Jan 2023 |
| PrivadoVPN | macOS IPv6 issue patched | macOS | FixedFix: macOS 3.1.0 | The version log calls it an IPv6 issue and does not say whether traffic leaked. | blog.privadovpn.comStated 22 Sep 2022 |
| PrivadoVPN | macOS Kill Switch failed after an Ethernet reboot | macOS | FixedFix: macOS 3.7.0 | Kill Switch bug fix in the macOS version log. | blog.privadovpn.comStated 8 Nov 2023 |
| Private Internet Access | IP leak with split tunnelling in bypass mode | Linux | FixedFix: 3.6.2 | PIA's changelog: fixed a potential IP leak when split tunnelling runs in bypass mode. | privateinternetaccess.comStated 7 Jul 2025 |
| Psiphon | WebRTC leak in the iOS browser and legacy Windows app | iOS, Windows | Affected | Applies to the standalone Psiphon Browser for iOS and to Psiphon 3 for Windows; Psiphon says it is not a concern for its full-device apps. | psiphon.caStated 18 Oct 2026 |
| PureVPN | Linux IPv6 leak and firewall rule reset | Linux | Affected | Affects GUI 2.10.0 and CLI 2.0.1. A fix was planned for mid-October 2025; the Linux release notes list nothing after 2.10.0. | purevpn.comStated 19 Sep 2025 |
| PureVPN | Linux IPv6 leak and firewall rule reset | Windows, macOS, Android, iOS | Not affected | The same advisory limits the issue to Linux. | purevpn.comStated 19 Sep 2025 |
| PureVPN | Linux DNS leak reported in 2023 | Linux | FixedFix: a Linux client patch, version not stated | PureVPN says it patched the DNS leak in its Linux client. | purevpn.comStated 20 Nov 2023 |
| Speedify | WebRTC and FaceTime IP leak on iOS | iOS | MitigatedFix: the IP Leak Protection setting in 16.5 | A new setting forces those calls through the tunnel; it can be switched off. | speedify.comStated 1 Apr 2026 |
| VPN Unlimited | Windows Kill Switch let P2P clients leak the real IP | Windows | FixedFix: the Windows Kill Switch update of October 2022 | Firewall rules rebuilt so P2P clients that bind to any interface cannot reach the internet outside the tunnel. The Kill Switch is off by default. | vpnunlimited.comStated 3 Oct 2022 |
| Windscribe | Linux IPv6 DNS leak protection gap | Linux | FixedFix: 2.23.11 | IPv6 DNS servers were missing from the leak protection rules. | github.comStated 6 Jul 2026 |
| Windscribe | DNS leak on Linux with resolvectl | Linux | FixedFix: 2.17.9 | From Windscribe's desktop release notes. | github.comStated 30 Sep 2025 |
| Windscribe | IPv6 leak with WireGuard and Allow LAN | Android | FixedFix: 3.74 | From Windscribe's Android release notes. | github.comStated 9 Jul 2023 |
Independent audits by provider
The latest audit of each kind that each provider has published or announced. “What was checked” is the scope the audit states; nothing outside it was examined.
| Provider | Date | Auditor | Type | What was checked | Findings | Source |
|---|---|---|---|---|---|---|
| Bitdefender VPN | 25 Jan 2023 | Aon | Servers and infrastructure | Privacy assessment of the VPN platform of Pango, Bitdefender's infrastructure partner at the time; Bitdefender's privacy policy now names a different processor. | Not published | SourceRead 18 Oct 2026 |
| Brave VPN | 8 Jul 2024 | Assured | Servers and infrastructure | Guardian VPN relays and API servers, including logging, March to April 2024. | 6 medium, 11 low | SourceRead 18 Oct 2026 |
| Brave VPN | 19 Mar 2024 | Assured | Backend and payments | White-box test of the Guardian app backend APIs, February 2024, commissioned by DNSFilter. | 1 high, 8 medium, 10 low | SourceRead 18 Oct 2026 |
| CyberGhost | 8 Dec 2025 | Deloitte | No-logs | Deloitte Audit Romania, ISAE 3000 limited assurance: server network, configuration, change management, incident response and dedicated-IP tokens. Third review. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2025 | KPMG | Privacy policy | ISAE 3000 assurance on the privacy and no-logs commitments. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | Nov 2024 | Cure53 | Apps | Aircove routers, second audit. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | Oct 2024 | Cure53 | Protocol | Lightway after its rewrite in Rust, fourth audit. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2024 | Cure53 | Browser extension | The VPN browser extension, second audit. | 1 medium | SourceRead 18 Oct 2026 |
| ExpressVPN | Sep 2022 | KPMG | No-logs | ISAE 3000 Type 1 assurance on the no-logs policy. | Not published | SourceRead 18 Oct 2026 |
| ExpressVPN | May 2022 | Cure53 | Servers and infrastructure | White-box review of TrustedServer, the in-house VPN server software. | None reported | SourceRead 18 Oct 2026 |
| ExpressVPN | Jun 2020 | PwC | Backend and payments | PwC Switzerland on the build verification process. | Not published | SourceRead 18 Oct 2026 |
| hide.me | 7 Jun 2024 | Securitum | No-logs | VPN container image, configuration files, deployment process and staff interviews against the no-logs claim, as of March 2024. | Not published | SourceRead 18 Oct 2026 |
| Hotspot Shield | 25 Aug 2023 | Aon | No-logs | Free and paid tiers, client and server side, against the privacy policy's logging claims; security controls and hosting excluded. Summary report only. | Not published | SourceRead 18 Oct 2026 |
| IVPN | 11 Apr 2024 | Cure53 | Backend and payments | Customer website, API, web servers and web infrastructure, in a test environment without production access. | 2 low, 2 info | SourceRead 18 Oct 2026 |
| IVPN | 15 Mar 2023 | Cure53 | Servers and infrastructure | Operating system and setup of the upgraded VPN gateway servers, in a test environment without production access. | 1 medium, 6 low, 1 info | SourceRead 18 Oct 2026 |
| Kaspersky VPN | 6 Feb 2024 | AV-Test | Apps | A test commissioned by Kaspersky of the Windows and Android apps: speed, encryption and IP leak protection. Not a no-logs or infrastructure audit. | Not published | SourceRead 18 Oct 2026 |
| Mozilla VPN | 6 Dec 2023 | Cure53 | Apps | The VPN apps for macOS, Linux, Windows, iOS and Android, tested in 2023; two items rated critical or high, all addressed. | Not published | SourceRead 18 Oct 2026 |
| Mullvad | 1 Jun 2026 | Leviathan Security | Apps | Android app 2026.2 against the App Defense Alliance MASA profile; black-box, no code review. | Not published | SourceRead 18 Oct 2026 |
| Mullvad | 6 Mar 2026 | Assured | Protocol | GotaTun 0.2.0, Mullvad's WireGuard implementation; DAITA, the CLI and external dependencies excluded. | 2 low | SourceRead 18 Oct 2026 |
| Mullvad | 21 Jan 2026 | X41 D-Sec | Backend and payments | White-box review of the account and payment API and backend; some findings redacted. | 3 medium, 2 low | SourceRead 18 Oct 2026 |
| Mullvad | 27 Jun 2024 | Cure53 | Servers and infrastructure | One OpenVPN and one WireGuard staging server plus the Ansible code, with a privacy focus. | 1 medium, 1 low | SourceRead 18 Oct 2026 |
| Mullvad | 22 Jun 2022 | Assured | No-logs | Two WireGuard and one OpenVPN server, freshly installed: configuration and any customer logging. | Not published | SourceRead 18 Oct 2026 |
| NordVPN | 18 Feb 2025 | Deloitte | No-logs | Deloitte Audit Lithuania, fifth engagement, with access from 18 November to 20 December 2024. | Not published | SourceRead 18 Oct 2026 |
| Opera VPN | 25 Sep 2024 | Deloitte | No-logs | Infrastructure of the free browser VPN on desktop, Android and iOS, June to August 2024; Opera VPN Pro excluded. | Not published | SourceRead 18 Oct 2026 |
| Opera VPN | 30 Mar 2022 | Cure53 | Apps and infrastructure | VPN backend plus desktop and mobile clients; only a summary report is published. | Not published | SourceRead 18 Oct 2026 |
| Private Internet Access | 8 Dec 2025 | Deloitte | No-logs | Deloitte Audit Romania, ISAE 3000: server configuration as of 31 October 2025, including dedicated-IP tokens. | Not published | SourceRead 18 Oct 2026 |
| Proton VPN | 1 Dec 2025 | Ruben Santamarta | Apps | Security audits of the apps by an independent researcher; the date is when Proton's article was updated. | Not published | SourceRead 18 Oct 2026 |
| Proton VPN | 19 Sep 2025 | Securitum | No-logs | On-site no-logs audit in Zurich, August to September 2025. | Not published | SourceRead 18 Oct 2026 |
| Psiphon | May 2024 | Cure53 | Protocol | White-box test of the Psiphon Tunnel Core code, April to May 2024; no critical findings, one high. | Not published | SourceRead 18 Oct 2026 |
| PureVPN | 17 Apr 2023 | KPMG | No-logs | KPMG Canada checked four no-log claims on 7 servers in 6 countries in February 2023; the letter says it was not a security or full privacy assessment. | Not published | SourceRead 18 Oct 2026 |
| Surfshark | Mar 2026 | Cure53 | Protocol | Architecture and cryptography of the Dausos protocol; only a summary is published. | Not published | SourceRead 18 Oct 2026 |
| Surfshark | 23 Jan 2026 | SecuRing | Servers and infrastructure | Black-box penetration test of the network infrastructure, 1 to 10 December 2025. | 1 medium | SourceRead 18 Oct 2026 |
| Surfshark | 16 Jun 2025 | Deloitte | No-logs | ISAE 3000: standard, static and multiport servers and their deployment. | Not published | SourceRead 18 Oct 2026 |
| Surfshark | 9 Jun 2025 | SecuRing | Apps | Web, desktop and mobile apps and extensions, February to April 2025; only an attestation letter is published. | Not published | SourceRead 18 Oct 2026 |
| TunnelBear | 24 Nov 2025 | Cure53 | Apps and infrastructure | Eighth annual white-box audit, October to November 2024: apps, backend and server configuration, public APIs and encryption. | Not published | SourceRead 18 Oct 2026 |
| Windscribe | Jun 2024 | Packetlabs | Servers and infrastructure | The FreshScribe VPN server stack. | Not published | SourceRead 18 Oct 2026 |
| Windscribe | Mar 2022 | Leviathan Security | Apps | Source review of the Android and iOS apps; Windscribe says all issues were fixed. | Not published | SourceRead 18 Oct 2026 |
| X-VPN | 30 Apr 2026 | Deloitte | No-logs | Deloitte Singapore, ISAE 3000 limited assurance on configuration and operations against the no-logs statements, as of 28 February 2026; two observations reported fixed. | Not published | SourceRead 18 Oct 2026 |
| ZeroTier | 23 Mar 2020 | Trail of Bits | Protocol | One-week review of the ZeroTier 2.0 cryptographic design; a preliminary review, not a code audit. | Not published | SourceRead 18 Oct 2026 |
Who runs each VPN
| Provider | Company | Country | Part of | Source |
|---|---|---|---|---|
| AdGuard VPN | Adguard Software Limited | Cyprus | Independent | SourceRead 18 Oct 2026 |
| Astrill | Veloxee Corp. | Liechtenstein | Independent | SourceRead 18 Oct 2026 |
| Bitdefender VPN | Bitdefender S.R.L. | Romania | Independent | SourceRead 18 Oct 2026 |
| Brave VPN | Brave Software, Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| Cloudflare WARP | Cloudflare, Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| CyberGhost | CyberGhost S.R.L. | Romania | Kape Technologies PLC | SourceRead 18 Oct 2026 |
| Edge Secure Network | Microsoft Corporation | United States | Independent | SourceRead 18 Oct 2026 |
| ExpressVPN | Express Technologies Ltd. | British Virgin Islands | Kape Technologies PLC (since 2021) | SourceRead 18 Oct 2026 |
| F-Secure VPN | F-Secure Corporation | Finland | Independent | SourceRead 18 Oct 2026 |
| hide.me | eVenture Limited | Malaysia | Independent | SourceRead 18 Oct 2026 |
| Hola VPN | Hola VPN Ltd. | Israel | Independent | SourceRead 18 Oct 2026 |
| Hotspot Shield | Anchorfree, LLC | United States | Pango Group | SourceRead 18 Oct 2026 |
| iCloud Private Relay | Apple Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| IVPN | IVPN Limited | Gibraltar | Independent | SourceRead 18 Oct 2026 |
| Kaspersky VPN | AO Kaspersky Lab | Russia | Independent | SourceRead 18 Oct 2026 |
| Mozilla VPN | Mozilla Corporation | United States | Mozilla Foundation | SourceRead 18 Oct 2026 |
| Mullvad | Mullvad VPN AB | Sweden | Amagicom AB | SourceRead 18 Oct 2026 |
| NetBird | NetBird GmbH | Germany | Independent | SourceRead 18 Oct 2026 |
| NordLayer | Nord Security Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| Opera VPN | Opera Norway AS | Norway | Opera Limited | SourceRead 18 Oct 2026 |
| OVPN | OVPN Inc. | Not stated | Independent | SourceRead 18 Oct 2026 |
| PrivadoVPN | Privado Networks ehf | Iceland | Independent | SourceRead 18 Oct 2026 |
| Private Internet Access | Private Internet Access, Inc. | United States | Kape Technologies (since 2019) | SourceRead 18 Oct 2026 |
| PrivateVPN | PrivateVPN Global AB | Sweden | Independent | SourceRead 18 Oct 2026 |
| Proton VPN | Proton AG | Switzerland | Proton Foundation | SourceRead 18 Oct 2026 |
| Psiphon | Psiphon Inc. | Canada | Independent | SourceRead 18 Oct 2026 |
| PureVPN | GZ Systems Limited | British Virgin Islands | Independent | SourceRead 18 Oct 2026 |
| Speedify | Connectify, Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| Surfshark | Surfshark B.V. | Netherlands | Nord Security | SourceRead 18 Oct 2026 |
| Tailscale | Tailscale US Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| TunnelBear | TunnelBear | Not stated | McAfee (since 2018) | SourceRead 18 Oct 2026 |
| Twingate | Twingate Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| VPN Unlimited | KeepSolid Inc. | United States | Independent | SourceRead 18 Oct 2026 |
| Windscribe | Windscribe Limited | Canada | Independent | SourceRead 18 Oct 2026 |
| X-VPN | LightningLink Networks Pte. Ltd. | Singapore | Independent | SourceRead 18 Oct 2026 |
| ZeroTier | ZeroTier, Inc. | United States | Independent | SourceRead 18 Oct 2026 |
How this table is kept
- Only the provider’s own words count: its blog, help centre, security advisory, changelog or release page. Reviews and news are used only to find them.
- Every status is tied to a short sentence on its source, and a script checks each week that the sentence is still there. If a source changes or disappears, the row is re-read by hand before it changes.
- “Not stated” means we looked and found no public statement for that app as of the check date - not that the app is safe or unsafe.
- These are statements, not tests. Both attacks need a hostile local network; the VPN leak test checks what your own connection shows right now.