Restore Privacy — Code & Policy Audit

Installer package AUDIT STATE (catalog v0.3.7)

Reader confidence for each current paid catalog installer after this security-audit pass. The STATE column shows a solid colour only (not the words Green/Amber/Red). Platform includes an OS-relative icon. On the status host, long Package / Notes text scrolls inside the cell (not by widening the full page). Regenerated by scripts/run_security_audit.py --write (4-hour timer).

Catalog overall (worst package):

Privacy probes (section B — audit timer)

Structured privacy checks run with the security audit (status-only; no LUKS format, no live ephemeral rebuild, no firewall/expose-surface scan).

Section B overall: PASS (firewall probe excluded by design)

In-scope probes: not all PASS (timer host should seed client/node scripts + fixtures).

Multihop node structure (audit timer)

Structural product-layout checks for multi-hop residual (entry → exit). Honesty: residual-via-exit when multi-hop enabled; not full intermediate onion encapsulation; default single-hop Iceland entry.

Multihop structure overall: PASS

1. Executive summary

Latest automated security audit for production node 82.221.101.241 and the in-repo privacy/security gates.

Core privacy thesis (unchanged): no user-info logs, minimal public status (title + downloads — no live client count), honest Connected only when residual full tunnel is active (residual_ip_capture), device Ed25519 keys (no shared client private key in packages), no third-party geo on Connect, session PFS + outer obfs as mitigations (traffic-analysis resistance only — not a claim of full protocol camouflage).

This pass (automated):

Overall posture: Strong for residual honesty (residual_ip_capture), no public live count, no-phones-home Connect, packaging strip of *.priv, tunnel DNS + DoT, Settings transparency. Multi-hop residual is opt-in (RPT_MULTIHOP_ENABLED=1): residual-via-exit (Romania); default single-hop Iceland entry — not full intermediate encapsulation. Windows 0.3.6 PE is rebuilt with multihop prep. Product kill-switch is off by default (opt-in `RPT_KILL_SWITCH=1` only). Installer package confidence is the RAG table at the top of this audit.

Primary residual risks (open by design / environment):

1. Operational — Product node is on FlokiNET in Iceland (strict Icelandic privacy / free-expression hosting norms). As far as we can be assured from FlokiNET’s public statements (“No invasive logs”; resource-usage monitoring only; no third-party tenant traffic/pattern sharing — https://flokinet.is/privacy/, https://flokinet.is/vps/), the host does not retain invasive logs of users connecting to the node. That is host-published posture, not a product forensic audit. Separate CDN/status hosts and home-ISP paths may still log. Node OS compromise (live RAM) remains residual.
2. Apple — residual IP requires signed Packet Tunnel / NE.
3. Linux privilege floor — residual needs root + TUN/ip.
4. Traffic analysis — padding/jitter/cover/outer obfs are mitigations only.
5. FDE / wipe / rebuild — at-rest only; unlocked root still sees secrets.

2. Scope and method

2.1 In scope

2.2 Method notes

• Public audit is served on the status host as /AUDIT.md and /audit.md (source repo is private).
• Product default host 82.221.101.241.
• Product node ElGamal pub pin: product/NODE_ELGAMAL_PUB.sha256 (SHA-256 1b126abf…).
• Did not paste secret material into this document.

3. Live node probe results

Expectation: /status returns title-only JSON (e.g. {"title":"RESTORE PRIVACY"}) — never a live client count.

4. Threat model scenarios

4.6 Threat model scenarios

Scenario A — VPS compromise

Production node placement: Iceland, hypervisor host FlokiNET. As far as we can be assured from FlokiNET’s public statements, the host does not retain invasive connection logs of users connecting to the node (“No invasive logs”; no third-party traffic/pattern sharing; overall resource usage only). If the VPS guest OS / root (production node) is fully compromised while sessions are active, in-memory session material may still be exposed. Product no-log / nolog composition reduces durable user-info logs on disk but does not erase live RAM. Residual risk: compromise of the node OS (distinct from FlokiNET’s published no-invasive-logs posture for tenant connection logging).

Scenario B — Traffic analysis by ISP

An ISP performing traffic analysis may still observe connection timing and volume. Outer obfuscation and traffic shaping mitigate fingerprinting; this is traffic-analysis resistance only, not a claim of full protocol camouflage. Residual risk: sophisticated network observers.

Scenario C — Client device seizure

Device seizure of a user machine may expose the local device key and residual config stored on disk. Packages never ship a shared client private key; keys are generated per device. Restore Internet executable (shipped with your download) will erase everything relating to this VPN from your device. Residual risk: local disk / unlocked endpoint compromise (if the failsafe was not run before seizure, residual product material may still be recoverable).

5. Findings (automated this pass)

6. Automated checks (this pass — 22 July 2026)

Modules: tests.test_legal_links, tests.test_legal_docs, tests.test_no_public_client_count, tests.test_connect_no_phones_home, tests.test_obfuscation, tests.test_kill_switch_leaks, tests.test_product_node_key, tests.test_pfs_product_require, tests.test_downloads, tests.test_multihop, tests.test_audit_package_rag

6.1 Package host credibility

7. Secrets & packaging checklist

8. Recommendations (non-binding)

1. Keep 4-hour timer enabled on the production node (install_security_audit_timer.sh).
2. Redeploy VPN APP Shop after audit link / catalog changes.
3. Keep multi-hop residual honesty: residual-via-exit when enabled; do not claim full intermediate encapsulation.
4. Ops: keep Unbound tunnel-only; no public :53; provider log awareness; zram+LUKS2 node-only on multi-hop hosts.

9. Conclusion

Automated security audit at 2026-07-22T13:00:14Z against node 82.221.101.241 and in-repo privacy gates. Public SECURITY AUDIT links must resolve on the status host (/AUDIT.md / /audit.md). Source repository is private; paid catalog installers are fulfilled on the status host only. Core privacy promises hold when the suite passes and status remains title-only.

Re-run: python3 scripts/run_security_audit.py --write

10. Follow-ups status

11. Document control