meshvpn

Security

A VPN has to be trustworthy. Here is how we work on that.

What meshvpn protects, what it doesn't, how releases are signed, and how to tell us about a problem.

Reporting a vulnerability

Please don't open a public issue. Write to security@plugovr.ai, or use Security › Report a vulnerability on GitHub. We confirm within 3 working days and fix critical and high findings within 30 days, usually much sooner. The full policy: SECURITY.md.

The model

  • Nodes have their own Ed25519 keys and sign everything they say about themselves. No node can speak for another.
  • Links are Noise XXpsk3: both ends prove their node key and the network key.
  • Packets are encrypted end to end between the two nodes that talk, with replay protection. Relays forward what they can neither read nor change.
  • Managed networks (the default): only admins invite, ban and change the admins. Invites are single-use, expire, and are bound to a one-time key. A ban rotates the network key.
  • Members are trusted with reaching each other. Which services a member may use is up to each machine's firewall.
  • The DHT rendezvous (optional) stores only encrypted, signed entries at places outsiders can't derive, with temporary IPv6 addresses only.

Signed releases

Every release from 0.27.0 on has SHA256SUMS.sig: an Ed25519 signature of the release's checksums, made with a release key the build machines don't hold. meshvpn update installs a release only if the signature verifies against the keys built into meshvpn, and the signature names the version, so an old release can't be passed off as a new one.

release key (Ed25519, PEM)
-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAhHYAO3iLkvQIVXUW8GHBOaGOY+6HqTPAFEH7XofinYk=
-----END PUBLIC KEY-----

To check a download by hand with OpenSSL 3, with the key above in release.pub and V the version without the v:

$ { printf 'meshvpn release v1\n%s\n' "$V"; cat SHA256SUMS; } > msg
$ tr -- '-_' '+/' < SHA256SUMS.sig | base64 -d > sig.bin
$ openssl pkeyutl -verify -pubin -inkey release.pub -rawin -in msg -sigfile sig.bin
Signature Verified Successfully
$ sha256sum -c --ignore-missing SHA256SUMS

Every release also has a CycloneDX software bill of materials (meshvpn-<version>.cdx.json) to match against vulnerability databases.

Audits and fixes

meshvpn is reviewed in rounds, and every fix is listed with what an attacker needed and what they could do, in the changelog. The latest rounds (November 2026) led to signed forgets and admissions, replay protection for data packets, limits before authentication, a hardened built-in SSH server, signed releases and invites bound to the invite.

What meshvpn doesn't protect against

  • A member of your network. Members can reach each other; invite only machines you trust, and ban the ones you no longer do.
  • Someone with root on one of your machines: they have that node's keys.
  • Traffic analysis: which of your machines talk to each other, and when, is visible on the networks between them.
  • The installer piped from curl comes from the release it installs. Check it as above first if that matters to you.