What each status actually means#
| Status | Meaning |
|---|---|
| Implemented in source | A capability is described and represented in the reviewed repository. Not a production qualification. |
| Locally checked website | A property of this website build was checked locally. Not an audit of the VPN. |
| Engineering / design preview | Controlled source behaviour or a supplied interface demonstration. |
| Planned | Intent or a future gate, not current protection. |
| Not established | The reviewed evidence does not support the stronger claim. |
See the evidence behind the claims#
The deployment owner controls the VPS and deployment authority.Implemented in sourceView evidence
- What this means
- Kurdistan VPN is software for independently operated deployments, not a shared server subscription.
- How the design works
- The operator runs kurd-node and uses kurdctl for local authority, profile issuance, revocation and recovery.
- The limit
- A person using a profile may not be its owner. You still trust that operator, the hosting provider and the software.
Reviewed . Source code alone is not release qualification.
No required central Kurdistan VPN account.Implemented in sourceView evidence
- What this means
- The product architecture does not require a central product login or public relay directory.
- How the design works
- An owner-issued profile and an explicitly confirmed deployment fingerprint establish the intended relationship.
- The limit
- This does not mean anonymous use. A VPS host, deployment operator or another service can have its own account requirements.
Reviewed . Source code alone is not release qualification.
Profile validity and owner trust are separate decisions.Implemented in sourceView evidence
- What this means
- A valid signature is not proof that a profile came from the person you intended.
- How the design works
- The Android import flow previews the profile, requires comparison of the deployment fingerprint, and confirms storage.
- The limit
- You need an independent, trusted way to compare the fingerprint. A code repeated by the same untrusted sender is not independent confirmation.
Reviewed . Source code alone is not release qualification.
Android profile storage is designed around local encryption.Implemented in sourceView evidence
- What this means
- The reviewed Android foundation uses encrypted storage backed by Android Keystore.
- How the design works
- Sensitive profile admission is bounded; the app accesses verification through a native Go bridge.
- The limit
- The browser preview is not that secure store. A compromised device or unsafe backup can still expose information.
Reviewed . Source code alone is not release qualification.
No required product advertising or analytics service.Implemented in sourceView evidence
- What this means
- Independent deployments do not depend on a Kurdistan advertising, analytics or remote crash-reporting service.
- How the design works
- The repository specifies local custody and categorical, secret-safe diagnostics rather than central traffic logging.
- The limit
- This does not establish a logging policy for every operator or VPS host. The website has its own, separate privacy notice.
Reviewed . Source code alone is not release qualification.
Runtime choices are bounded by the signed profile.Engineering / design previewView evidence
- What this means
- The app may narrow a verified plan, not invent a relay, strategy or fallback outside it.
- How the design works
- The compiler/runtime implements authenticated stream semantics, policy checks, replay and downgrade checks.
- The limit
- Source and controlled tests do not establish leak prevention on every phone. Android lockdown is a separate system policy.
Reviewed . Source code alone is not release qualification.
The engineering path is designed to keep DNS inside the tunnel.Engineering / design previewView evidence
- What this means
- DNS policy belongs to the authenticated connection, not an opportunistic public-resolver fallback.
- How the design works
- The relay implementation documents a Kurd TLS connection and TUN-scoped resolver policy.
- The limit
- The public production egress path and broad device validation are not established as released. This is not a blanket DNS-leak guarantee.
Reviewed . Source code alone is not release qualification.
Grandma Mode demonstrates a simpler interface.Engineering / design previewView evidence
- What this means
- Large text, fewer choices and guided help offer another view of the same connection model.
- How the design works
- The supplied design prototype contains Home / Help / Settings and explicit setup and recovery steps.
- The limit
- This is design-prototype evidence, not proof that this exact experience ships in an available APK. Translation review and real-user studies remain necessary.
src/prototype/app.htmlReviewed . Source code alone is not release qualification.
A production Android download is not established.Not establishedView evidence
- What this means
- There is no production APK offered by this website.
- How the design works
- The reviewed README explicitly marks the software pre-release; the releases API returned no published releases at review.
- The limit
- The source snapshot is not a live status feed. Check the repository for newer, independently verifiable release evidence.
Reviewed . Source code alone is not release qualification.
Internal tests are not an independent security audit.Not establishedView evidence
- What this means
- The repository includes substantial regression and assurance tooling.
- How the design works
- Adversarial, mutation, parity and security checks are described in the source.
- The limit
- No independent release-candidate audit report was established in the reviewed evidence. No certification or third-party assurance is claimed.
Reviewed . Source code alone is not release qualification.
This website build contains no analytics or advertising integration.Locally checked websiteView evidence
- What this means
- Reading these pages does not require a third-party script, remote font service or tracking cookie.
- How the design works
- Static documents and local assets; preferences stay in browser storage when available. Search runs locally.
- The limit
- Verified by local source/runtime inspection only. The eventual hosting provider receives web requests; its log retention requires an operator policy.
src/client/site.jstests/refinement.browser.mjsReviewed . Source code alone is not release qualification.
Platform and deployment support must be checked for the exact build.Not establishedView evidence
- What this means
- Source availability does not establish protection on every device or network.
- How the design works
- Release gates must bind source, artifacts, signatures and exact-build qualification before public download claims change.
- The limit
- There is no release date, delivery guarantee or supplementary-protocol support promise.
Reviewed . Source code alone is not release qualification.
What the evidence does not establish#
We do not claim guaranteed anonymity, undetectability, successful censorship bypass, universal leak prevention, an independent security audit or a production-ready Android release.
Read assumptions and threat boundariesUnderstand release verificationFound a security concern?#
The repository asks for private reporting to its owner rather than a public issue containing exploit details or secrets. This site does not invent a security inbox or response promise.
Read the reporting guidanceSource and scope
Reviewed . The linked source describes the implementation; released-build evidence is a separate check.