Security
How Teitunnel protects your credentials, your DNS and your computer.
The full model is in SECURITY_MODEL.md. To report a vulnerability, see SECURITY.md.
Credentials
- Cloudflare tokens and tunnel run tokens are stored only in your system's keychain (Keychain on macOS, Credential Manager on Windows, the Secret Service on Linux), never in files, logs or the app's database.
- The window never sees them: its requests name an account, and the core fetches the token itself.
- A connector running while the app runs gets its run token in memory, never on the command line (where other users could see it). An Always-on connector reads it from a file only you can read, removed when you turn Always-on off.
Your DNS
- Every change is shown before it's made and recorded in Activity.
- Only records Teitunnel created are ever deleted without asking. See DNS ownership.
Your computer
- Nothing is exposed until you share or route it.
- Processes are started with explicit arguments, never through a shell.
- Metrics and diagnostics endpoints listen on
127.0.0.1only. - cloudflared downloads are checked against GitHub's digest, Cloudflare's published checksum and Cloudflare's code signature before use.
- Logs and diagnostics exports have tokens, keys and passwords removed.