Current Security Model
Security characteristics of Exposr v0.4.
Experimental — Not Production Ready
Exposr v0.4 is an experimental proof of concept. Do not use it to expose sensitive services in production environments without additional security controls.
Status
The current version provides basic agent authentication on the control channel but lacks several security features needed for production use.
What exists
- Agent token authentication — The control channel requires a matching agent token. The server rejects connections with invalid tokens before accepting the agent or opening tunnels.
- Port ownership tracking — The server tracks which agent owns each public port and releases ports on disconnection.
Known limitations
- TCP only — no encryption
- No TLS on any channel
- Data connections (port 9001) are not separately authenticated
- No domain or subdomain routing
- No rate limiting or abuse protection
- No user accounts or access control
- No connection limits
- Publicly exposed services must be secured by the user
Planned improvements
Note
The following features are planned but not yet implemented.
- TLS encryption on all channels
- Per-data-connection authentication
- Secure tunnel registration
- Rate limiting and connection limits
- Abuse prevention
- Tunnel ownership validation