Provider-neutral self-test pilot
TunnelBear is worth reading differently on two axes. Its kill switch is called VigilantBear, so if you are hunting for a setting after a failed check that is the name to look for. And it has published an independent security audit every year since 2016, carried out by Cure53 with full access to source code and configuration, which is a longer public record than most providers hold. The output describes this browser right now, not TunnelBear's service as a whole.
Live test
TunnelBear's kill switch is called VigilantBear, and SplitBear can remove traffic from the tunnel on purpose. Read a surprising address against both.
Current-session checks
Take a reading before connecting and another after. On TunnelBear the first thing to settle is whether VigilantBear was on when the reading was taken, because that decides what a surprising result means.
Before you read the result
TunnelBear's blog and product documentation are the source for the points below, including its unusually long public audit record.
TunnelBear describes VigilantBear as the feature that stops your device sending unencrypted traffic if TunnelBear disconnects. It is the setting behind most unexpected readings here, and it is worth confirming its state before and after the test rather than assuming it was on.
TunnelBear states that its Chrome and Firefox extension secures browser data only, while the Windows and macOS apps secure everything leaving the computer. If you are running the extension, a check on this page describes the browser and nothing else on the machine - which is the correct behaviour of that product, not a shortfall in the test.
SplitBear lets you exclude specific applications and websites from the tunnel without disconnecting, and TunnelBear is explicit that excluded apps and sites are not encrypted or protected. An exclusion added for a service that blocks VPNs is a common and documented reason a later check reports your own address.
TunnelBear has commissioned an independent security audit every year since 2016, published on its own blog, with Cure53 performing white-box assessments that include source code, configuration and internal documentation. The 2024 report counted ten vulnerabilities of medium severity or higher and three low ones; a ninth annual audit followed in 2025.
An audit is a statement about the provider's code and infrastructure at a point in time. It cannot tell you what your particular browser exposed a moment ago. That is the gap these checks fill, and it is why a clean audit history and a surprising local reading are not a contradiction.
Between the readings
VigilantBear is TunnelBear's name for its kill switch, so that is the setting to have open while you do this. The recorder reports whether your own address was reachable while the tunnel was down, and for how long.
Safe Copy exports use safe summary categories and remove raw IP, exact city, full user-agent, raw fingerprint data, raw resolver IPs and WebRTC candidates. It is not a certificate, provider audit, or proof of anonymity.
FAQ
VigilantBear is TunnelBear's name for its kill switch. TunnelBear describes it as preventing the device from sending unencrypted traffic if the VPN disconnects, so it is the setting to confirm after an unexpected reading.
No. TunnelBear says the Chrome and Firefox extension secures browser data only, while the Windows and macOS apps secure everything leaving the computer. Which one you are running changes what these checks can see.
It can. SplitBear excludes chosen apps and websites from the tunnel without disconnecting, and TunnelBear notes that excluded traffic is not encrypted or protected. Review the exclusion list before treating the reading as a fault.
TunnelBear has published an independent security audit every year since 2016, carried out by Cure53 as a white-box assessment with access to source code, configuration and internal documentation. The reports are on TunnelBear's own blog.
No. An audit describes the provider's code and infrastructure at a point in time. These checks describe what your browser exposed in this session, which depends on your device, your extensions and your settings.
WebRTC candidates are produced by the browser. They should carry the tunnel address when the whole system is routed through the app, but an extension, a virtual adapter or a split-tunnel rule can change that.