Security
How the system is put together, what we do not claim, and how to report a vulnerability.
How a connection is protected
- Traffic between two devices is encrypted with WireGuard, end to end. The coordinator introduces the devices and never carries their traffic.
- Each device holds its own signing key, kept non-exportable where the platform allows it. Signing in uses a Google account plus a passkey, and adding a device needs approval from a passkey or a device already enrolled.
- The coordinator issues an Ed25519-signed ticket bound to both ends’ WireGuard keys. A forged or altered ticket fails at the handshake, and both ends verify it without calling a server mid-connection.
- An exit terminates traffic in a userspace network stack and checks every connection against its owner’s rules before anything leaves.
- Private, loopback, link-local and cloud-metadata addresses are refused in code on every exit. There is no setting that opens them, so a connection through someone’s device can never reach their home network.
- A relay forwards packets it cannot decrypt. It sees that two addresses exchanged traffic and how much.
- Usage is metered at both ends and signed, so neither side can quietly rewrite what a session cost.
What we do not claim
- No independent security audit has been done yet. When one is, the report will be linked here.
- SparkUp is not an anonymity network. The network an exit sits on can see destination addresses, and the exit software reads destination names to apply rules.
- Domain rules depend on the names a connection reveals. Encrypted names (ECH) can slip past them, which is why port and address rules always apply as well.
- The source code is not published, so you cannot verify these claims by reading it today.
Reporting a vulnerability
Write to contact@sparkupco.net with “Security” in the subject. Include what you found, how to reproduce it, and how you would like to be credited. Our machine-readable contact is at /.well-known/security.txt.
- We aim to acknowledge within five working days and to keep you updated until it is fixed.
- Research in good faith is welcome and we will not pursue legal action over it.
- Please test against your own accounts and devices: do not access other people’s data, degrade the service, or run denial-of-service tests.
- Please give us 90 days before publishing, or less if we agree on it.
- There is no bug bounty yet. We will say so honestly rather than imply a reward.