Help · Security

Node Attestation

A config-verified badge means the node's software reported, with a signature, that its managed VPN config keeps logging off. It is a self-check that deters casual tampering, not a guarantee against traffic capture.

Open in the app All help topics
example
no badge           → no passing self-check on record
◇ config-verified  → the node's signed self-check passed

Some nodes on the marketplace carry a muted ◇ config-verified badge. It reflects a check the node's own software runs.

What the check does

  • When the node connects, and then every hour, ProofKit asks it for an attestation.
  • The agent reads the node's Xray config and its nginx entry-proxy config. The check fails if Xray's access log is a file (on an exit that runs Torrent Guard's connection watch it is a pipe that the agent reads and nothing stores), logs at debug or info level, or logs DNS queries, or if nginx has an access log switched on.
  • The agent signs the result with the node's key. A passing report sets config-verified; a failing one removes it and raises a warning flag.

What it does not mean

  • It is a self-report. An operator with root access could change the agent itself to report a pass, or capture traffic with a separate tool.
  • It covers Xray and the entry proxy only; the olcRTC server is not part of the check.
  • It is not a guarantee that nobody can see your traffic. Choose a VPN setup accordingly.

No badge

Most nodes show no badge. That implies nothing bad: the node simply has no passing self-check on record.

What actually limits what one operator can see is the route: on a 2-hop route the entry does not see your destinations and the exit does not see your IP address, as long as different operators run them. See Staying safe.