Security, and where it stops

The transport

Every connection runs VLESS over Reality. Reality mirrors the TLS handshake of a genuine, unrelated web server, so a network watching the line sees what looks like an ordinary HTTPS session. Nothing is self signed, no certificate warning appears, and there is no distinctive handshake for equipment to match against.

The key

• A key is issued by the bot and belongs to one customer
• It works on up to 5 devices at once, which is a limit, not a license to share
• It stops on its expiry date, since nothing renews on its own
• If a key leaks, ask in the bot and it is replaced

What we can see

A server has to know where to send packets while it is forwarding them, which is true of every network device between you and any site. What it does not do is write that down. There is no account to attach it to and no log to search later, which is the reason the service was built without accounts in the first place.

What a tunnel does nothing about

• Malware already on the device
• Passwords you reuse across services
• A phishing page, which looks exactly the same inside a tunnel
• Accounts you sign into, which identify you regardless of the address you arrive from
• Browser fingerprinting, cookies and anything else above the network layer

Practical advice that is not about us

Turn on the kill switch in your client, usually worded as blocking traffic when the tunnel is down. Keep the client updated from its own release page rather than from a mirror. Use a password manager and two factor authentication, which will do more for your security than any tunnel.