Security at InstaTunnel

Practical controls for protecting tunnel connections, visitors, domains, and the infrastructure that carries your development traffic.

Authenticated connections and verified domains

Implemented security controls

These are the controls currently enforced by the production service. This page does not claim third-party security certification.

Encrypted transport

Public tunnel traffic uses HTTPS, while the CLI connects to the relay over an authenticated secure WebSocket connection.

Tunnel ownership

Named tunnels and reconnects require the owning account credential. Concurrent clients cannot silently replace an active tunnel.

Verified custom domains

A custom domain is not routed until its owner completes the DNS TXT verification challenge shown in the dashboard.

Visitor access controls

Pro and Business tunnels can enforce a tunnel password or HTTP Basic Authentication before a request reaches the local service.

Private service boundaries

Database, cache, application, metrics, and monitoring services are isolated from the public network behind the HTTPS reverse proxy.

Automated checks

Production checks continuously verify route authentication, tunnel ownership, visitor protection, long requests, and service health.

How tunnel traffic flows

HTTPS terminates at the InstaTunnel edge so the service can route the request to the correct tunnel. The request is then relayed to the authenticated CLI connection and forwarded to your local application.

Tunnel traffic is processed in transit and is not advertised as end-to-end encrypted or zero knowledge. Operational metadata and security events may be retained as described in our privacy policy; application owners should avoid exposing unnecessary sensitive systems.

Protect sensitive applications

  • Use --password or --auth user:password for staging tools and private previews.
  • Keep API keys in environment variables or a credential manager, never in source control or screenshots.
  • Close tunnels when they are no longer needed and review active tunnels in the dashboard.
  • Keep the npm CLI current with npm install -g instatunnel@latest.
  • Treat a public tunnel URL as internet-accessible unless visitor protection is enabled.

Report a security issue

Send a private report with reproduction steps, affected endpoints, and impact. Do not access other users' data or disrupt production traffic while testing.

support@instatunnel.my

Good-faith reports are reviewed under the responsible disclosure and bug bounty terms published by InstaTunnel.

To report phishing or other abuse on a *.instatunnel.my tunnel, email support@instatunnel.my with the full URL. Confirmed phishing tunnels are deactivated immediately, and repeat sources are blocked.