Security policy

MEHS has not been independently audited or certified safe for production use. Do not send real user traffic through an unreviewed deployment.

The original early-stage policy predates the working tunnel features listed in the current support matrix. Feature availability does not remove its production-use warning.

Before production deployment, complete the threat model, verify strict protocol parsing and authenticated transports, validate malformed-input handling and resource limits, and obtain an independent security review.

Do not publish sensitive server details, credentials, private keys, or live exploit data publicly. Report sensitive issues to the maintainer through an established, trusted private channel.

See the threat model and protocol security requirements.