Security model

What is isolated

Upstream credentials are never exposed to the renter. The control plane (server/) is the only place that reads or writes the database, including the upstream proxy address, username, and password. The data plane (edge/) is the only place that forwards traffic; it does not talk to the database directly. It pulls a link’s configuration - expiry, traffic cap, pool members - from the control plane and caches that configuration locally, and reports usage back periodically. A renter only ever interacts with the data plane, through a relay link as described in Relay links, so the upstream credentials never pass through anything the renter can inspect.

Anti-block, not censorship circumvention

The client-to-relay hop is a relay / WebSocket connection, not the upstream proxy protocol itself: a watcher on that hop sees a relay connection, not the address or protocol of the upstream proxy. That is about not exposing the upstream proxy on the client-to-relay leg, not a tool for bypassing a destination’s own restrictions or a censorship-circumvention product.

Two honest caveats

We do not oversell this. Two limitations are worth stating plainly:

• Upstream passwords are stored in plain text. The upstream proxy password is a plain-text column in the database, not an encrypted or hashed value, because the control plane has to be able to forward it to the data plane on every request. A renter cannot see it - the API and UI only ever expose the relay link - but anyone with direct database access can.
• Revocation is not instant. A revoked link can stay usable for up to about 60 seconds while the edge cache expires. The data plane caches a link’s configuration in its own storage and only refreshes it periodically; revoking a link updates the control plane immediately, but the data plane keeps forwarding traffic against its cached copy until that cache entry expires, roughly a minute later. If the two services cannot reach each other at all, the same 60-second cache TTL is what eventually invalidates the link on its own.

Neither caveat is a bug we plan to silently patch away; they are the current, documented trade-offs of the architecture. See Limits and revocation for how expiry, traffic caps, and revocation fit together, and What Proxy Bastion does not do for the rest of the limits.