How this is built, and where it stops.

Report a vulnerability

Write to [email protected]. We will confirm within 72 hours and keep you updated until it is fixed. We will not take legal action against research done in good faith against your own machines and your own account — do not test against other people’s. Machine-readable contact: /.well-known/security.txt.

The shape of it

The agent keeps one outbound TLS connection to the edge on port 443; nothing on your machine listens for the internet. All streams share that connection, and the agent proxies only to the addresses you published — it is not a route into your network. Its token travels inside the connection, not in a URL.

Links as credentials

• Every link id carries 256 bits of entropy. It cannot be guessed or enumerated.
• A link can require a password, or a signed-in account, or specific email addresses.
• A link can expire on a deadline or after a number of uses.
• Raw TCP and UDP publications need a knock first, then the caller’s IP is allowlisted.
• Rotating an id kills the old URL and keeps the tunnel. Revoking refuses new connections.

Command policy

Read-only mode and allow/deny lists are checked at the edge for the browser terminal, MCP run_command and file writes, so a blocked command never reaches the shell. It is a byte-stream filter, not a security boundary:

• Input inside a full-screen program is not parsed.
• Lines from history or Tab completion are refused — the edge cannot reconstruct them.
• A deny list does not stop interpreters such as python -c; read-only refuses them.
• A native ssh client over the link is a raw byte pipe with no filter.
• With the control plane unreachable, new command and file operations are refused.

On a machine that matters, pair it with an OS account that cannot do damage.

Your account

• Passwords are hashed with argon2id. TOTP two-factor is available. Google and Apple sign-in are optional when the operator configures them. Cloudflare Turnstile can be required on registration, sign-in and password-reset requests.
• API tokens are scoped — read, tunnels:write, connect — stored as hashes, and revocable.
• Link access is written to an audit log with who, when and from where.

Encryption in transit

Everything is TLS 1.3. By default the edge terminates it — that is what makes the browser terminal and the command filter possible. In end-to-end mode the key never leaves your machine and the tunnel is opaque to us; the browser terminal and HTTP links are off, and MCP commands and file transfers still cross the edge in the clear.

The install script

Fetching it does not use up the token, so you can read it first. It prints the service user before changing anything — the user who invoked sudo, or the current user (possibly root) — and remote commands keep that account’s permissions, including its sudo rules. It verifies the binary’s SHA-256, adds no sudo rule and leaves sshd and the firewall alone. To remove it: sudo systemctl disable --now linkport-agent, then delete the unit file and /usr/local/bin/linkport.

What is not done yet

• Agent binaries are checksum-verified but are not yet signed with an offline release key.
• Revoking a link refuses new connections but does not tear down a session already open.
• The audit log records link access; it does not yet record link issue, rotate and revoke.
• Email confirmation and password reset go through Postal; public password registration is disabled when verified mail delivery is not configured. Provider-verified Google/Apple emails count as confirmed.
• Session recordings live on a local volume, not object storage.
• No third-party penetration test, and no SOC 2. One region, one edge, beta.