The latest release of MoonProxy is the only version that receives security updates. Please always run the most recent stable version from GitHub Releases.
| Version | Supported |
|---|---|
| latest | ✅ Active |
| older | ❌ End of life |
If you discover a security issue in MoonProxy (or in how the bundled frpc binary is fetched and verified), please do not open a public issue.
- Preferred channel: GitHub private security advisory.
- Email (fallback):
moonproxyhq@outlook.com(PGP key on request).
Please include:
- A clear description of the vulnerability and its impact.
- Reproduction steps / a minimal proof-of-concept.
- Affected version(s) and platform (macOS / Windows, arch).
- Whether the issue is in MoonProxy itself, the bundled frpc, or how the engine is updated.
We will acknowledge within 72 hours and aim to ship a fix (or a documented mitigation) within 30 days for high-severity issues.
- MoonProxy source code (Tauri / Rust / Vue / TypeScript) in this repository.
- The SHA256-verified atomic-swap pipeline that fetches frpc from upstream GitHub Releases.
- Local configuration files (
frpc.toml,config.store.json,prefs.json) generated by the app.
- Issues in the upstream fatedier/frp project itself — please report them upstream. MoonProxy only bundles the frpc binary and follows its protocol.
- User-operated frps servers — security of the server side is the server operator's responsibility.
- Enable
transport.tls.force = truein your frpc configuration (defense in depth). - Use a strong, unique token for your frps server and rotate it periodically.
- Restrict the public-side firewall to only the ports you actually need exposed.
- Pin engine updates: rely on the built-in SHA256 check; do not sideload frpc binaries from untrusted sources.