Security model
The public URL is not the secret
Section titled “The public URL is not the secret”The Quick Tunnel URL is public; it is not the secret. Authentication is the one-time pairing token delivered only through the QR code at session start.
Pairing token
Section titled “Pairing token”- The token travels in the URL fragment (
#pair=…) so it never reaches the HTTP server or Cloudflare. The web client sends it only in the first WebSocket auth message. - Single-use and expires in 5 minutes.
Session credential
Section titled “Session credential”After pairing, the client receives a short-lived, revocable session credential
stored in sessionStorage. Tokens are hashed server-side; comparisons are
constant-time.
Network binding
Section titled “Network binding”- By default the server binds to
127.0.0.1(local only). - With
--lanit binds to0.0.0.0(expose to your local network) — use only on trusted networks.
WebSocket origin check
Section titled “WebSocket origin check”WebSocket Origin is checked. Terminal contents are never logged.