How this is built, and where it stops.

Report a vulnerability

Write to [email protected]. We will confirm within 72 hours and keep you updated until it is fixed. We will not take legal action against research done in good faith against your own machines and your own account — do not test against other people's. Machine-readable contact: /.well-known/security.txt.

The shape of it

The agent on your machine opens one outbound TLS connection to the edge on port 443 and keeps it. Nothing on your machine listens for the internet, so there is no inbound rule to write and no port to forward. Client streams are multiplexed inside that one connection. The agent proxies only to the local addresses you published — it is not a general route into your network.

The agent's token travels inside the established connection, not in a URL. The edge terminates TLS itself, so there is no extra reverse proxy hop.

Links as credentials

• Every link id carries 256 bits of entropy. It cannot be guessed or enumerated.
• A link can require a password, or a signed-in account, or specific email addresses.
• A link can expire on a deadline or after a number of uses.
• Raw TCP and UDP publications need a knock first, then the caller's IP is allowlisted.
• Rotating an id kills the old URL and keeps the tunnel. Revoking refuses new connections.

Command policy

Read-only mode and allow/deny lists are checked at the edge — for the browser terminal, for MCP run_command, and for the file tools that would change something. A blocked command is stopped on the way in rather than reported afterwards, and the session can be recorded either as command lines or as a full asciinema cast.

It is a byte-stream filter, not a security boundary, and we would rather you knew the edges: input typed inside a full-screen program is not parsed; recalled history and Tab-completed lines are rejected because the edge cannot reconstruct them safely; interpreter escapes such as python -c pass through; a native ssh client tunnelled over the link is a raw byte pipe with no filter on it; and if the control plane is unreachable the edge rejects new command and file operations. Treat it as a hard stop on accidents and a speed bump on intent. On a machine that matters, pair it with an OS account that cannot do damage.

Your account

• Passwords are hashed with argon2id. TOTP two-factor is available. Google and Apple sign-in are optional when the operator configures them. Cloudflare Turnstile can be required on registration, sign-in and password-reset requests.
• API tokens are scoped — read, tunnels:write, connect — stored as hashes, and revocable.
• Link access is written to an audit log with who, when and from where.

Encryption in transit

Everything is TLS 1.3. By default the edge terminates it, which is what makes the browser terminal and the command filter possible — a server cannot both enforce a command list and see only ciphertext, and we will not claim both. End-to-end mode generates the key on your machine and never lets it leave, so the tunnel payload is opaque to us; the browser terminal and the HTTP proxy are switched off in that mode because they cannot work. Even then, MCP commands and file transfers cross the edge in the clear, because they ride the agent control channel.

The install script

Fetching it does not consume the install token, so you can read the script first and install afterwards. It prints which user the service will run as before it does anything, and that defaults to the user who invoked sudo, or the current user (including root) otherwise. Remote commands retain that account's normal permissions, including its existing sudo rules. It verifies the downloaded binary with SHA-256, adds no sudo rule, touches no sshd configuration and writes no firewall rules. To remove it: sudo systemctl disable --now linkport-agent, then delete the unit file and /usr/local/bin/linkport.

What is not done yet

We would rather list these than have them found:

• Agent binaries are checksum-verified but are not yet signed with an offline release key.
• Revoking a link refuses new connections but does not tear down a session already open.
• The audit log records link access; it does not yet record link issue, rotate and revoke.
• Email confirmation and password reset go through Postal; public password registration is disabled when verified mail delivery is not configured. Provider-verified Google/Apple emails count as confirmed.
• Session recordings live on a local volume, not object storage.
• No third-party penetration test, and no SOC 2. One region, one edge, beta.