Data and egress surfaces (v1.8.0)
The 1.8.0 surfaces add new local and network behaviors. All of them are off by default or strictly local unless you opt in:
- Plugin marketplace — catalog metadata is fetched from the configured catalog URL only when you run a marketplace command; plugin installs download an archive and verify its
SHA-256against catalog metadata before extraction. Setmarketplace_verify=falseonly for self-hosted testing. - Webhooks — when configured, event payloads are delivered over HTTPS to operator-defined URLs with an HMAC-SHA256 signature (
X-Blackout-Signature). Redirects are not followed. There is no built-in remote log sink. - Access policy — a policy file can be HMAC-signed; verification is local and never contacts a server. Distribution of the signed policy is the operator's responsibility.
- REST API v2 — loopback-only (
127.0.0.1) and read-only; webhooks/plugins/devices/compliance are exposed locally. The/ws/eventsWebSocket is also loopback-only. - Enterprise RBAC & compliance — roles, the device registry, and the GDPR / HIPAA / SOC 2 score are computed entirely from local settings. Nothing is uploaded.
Full egress inventory: see NETWORK_PRIVACY.md.
What Blackout Kit does provide
- Local runtime orchestration
- Local readiness and route guidance
- Machine-bound encrypted storage for saved proxy URIs and supported secrets
- Linux endpoint-scoped kill switch support
- Targeted cleanup of Blackout-owned crash leftovers
What it does not guarantee
- Anonymity
- Traffic-analysis resistance
- That a country profile will work on a given network
- That a green local readiness check means the tunnel will succeed
- That an upstream server is trustworthy
Security modes
- speed — compatibility-focused local settings
- private — randomized XRay fingerprint plus MUX
- legend — stricter handling for known-bad normal TLS certificates
These are local configuration presets, not privacy guarantees.
Kill switch policy
The supported kill switch is Linux-only. The old Windows Firewall approach is intentionally unsupported and its legacy rules are removed instead of being treated as safe protection.