Security model
Understand authentication, secret handling and protection limits.
Overview
Umbra combines authentication before the first server response with a real-site fallback model. An unauthenticated connection is forwarded to the configured destination rather than receiving a distinctive proxy authentication error. Authenticated clients validate the expected identity material. Replay protection is bounded by capacity and time; it is one part of the model rather than an unlimited protection against resource exhaustion.
Details
The code centralizes constant-time verification and zeroizing secret wrappers. Keep private_key and mldsa_seed on the server, protect client configuration distribution, and avoid copying keys, target addresses or payloads into logs or bug reports. The local SOCKS endpoint negotiates no-auth, so loopback binding is the default deployment advice. Client applications should continue to use HTTPS or their own authenticated encryption.
Verify
A privacy transport does not make compromised endpoints safe, hide every traffic pattern, or provide anonymity equivalent to a multi-hop anonymity network. The current alpha has no claim of an independent security audit or complete equivalence with current Chrome. chrome-latest remains a historical Chrome 150 profile; Chrome 153 capture evidence is not full conformance. Use the project security page for currently published reporting information, and do not publish sensitive vulnerability details or operational secrets in an ordinary public issue.