Security
Security
V2Root uses security controls to protect accounts, access credentials, devices, and service infrastructure.
Last updated: July 3, 2026
Security approach
- Account passwords are stored as password hashes, not plain text passwords.
- Access credentials and sensitive session tokens should be stored as hashes in production systems.
- Authorized access should be validated through the API and bound to an authorized device.
- Security logs may be used to detect abuse, account attacks, suspicious devices, and unauthorized access.
- Administrative actions should be limited to authorized administrators and recorded for auditability.
VPN configuration security
VPN server configuration should be delivered through authenticated API requests. The app should not permanently hard-code private configuration URLs, protocol details, regional routing names, or secrets.
Responsible disclosure
If you discover a security issue, report it through the contact page. Please include clear reproduction steps, affected endpoints or app versions, and avoid accessing or modifying data that does not belong to you.
No harmful testing
Do not perform denial-of-service testing, automated scanning, exploitation, or data extraction against V2Root systems without written permission.