Proof Status

Real inline blocking on both Nginx and Apache since v14.8.0 - confirmed against an actual blocked request returning 403, not just a rule existing in config. Earlier marketing had falsely implied this before v14.8.0; that overclaim was corrected.

Reads real-time protection status and exclusions directly from Defender's own provider - not a static assumption.

Real scans via the bundled (Full edition) or on-demand-downloaded (Lite edition) ClamAV binary. An EICAR test file was correctly flagged.

Coordinator startup, preauth key issuance, and node registration all confirmed against a real running server. A real bug was found and fixed this same day: the generated config bound to 127.0.0.1 only, which would have silently prevented any node on a genuinely separate machine from ever reaching the coordinator, even though the invite flow was already advertising the LAN IP. Now binds 0.0.0.0 and advertises the real reachable IP.

Self-compiled from the open-source Tailscale daemon/CLI under ProxyStack's own service and binary name. Both the Windows and Linux builds were confirmed installing as a real system service (Windows service / systemd unit) and completing an actual mesh join.

The REST client matches NetBird's documented management API surface, but has not been live-tested end-to-end against a real running NetBird management server (customer-hosted - NetBird's server components are AGPL-3.0, so ProxyStack doesn't bundle or run them). Checked why a quick local test wasn't feasible (2026-07-08): NetBird's own self-hosted quickstart genuinely requires a public domain name and public inbound access on ports 80/443/3478 - unlike Headscale, there's no supported localhost/LAN-only path, so this needs a real customer environment to verify, not something fabricable for a quick test.

A real WSL2 Ubuntu node joined a real Headscale coordinator through this exact code path. Confirmed two ways: the client reported a real assigned mesh IP, and independently, the coordinator's own node list showed the peer registered with online: true. Two real bugs were found and fixed getting here: a nonexistent --unattended flag (this Tailscale CLI build has none) and a wrong flag name (--auth-key, not --authkey) plus a missing --socket flag needed to reach a daemon on a non-default socket path.

Re-verifying this against a real second Windows machine (a VirtualBox VM) surfaced and fixed 3 more real bugs: ApiServer bound to localhost only (even the machine's own real LAN IP was rejected - now fixed and confirmed reachable via a real LAN call), the Modern UI had no code path that ever started ApiServer at all (Classic UI only - now added to Settings/Security), and FindOrInstallProxyStackVpn silently reported success even when Windows service registration failed for lack of elevation (now verified via sc query and requests real UAC elevation). What's still not confirmed: the interactive UAC consent prompt itself requires a human at a real desktop to click "Yes" - not available through headless VM automation, so that one specific step is code-reviewed and uses a standard, well-established Windows API pattern, but hasn't been watched succeeding live.

Local heuristics and VirusTotal lookups both exercised against real running processes. A real inverted-condition bug in auto-detonation wiring was caught before shipping.

Confirmed catching process, file, registry, and network behavior from a real synthetic test sample. Known limitation: network connections are checked once at the end of the monitoring window, so a very short-lived connection can be missed (the same limitation the VM tier had until its 2026-07-08 fix).

Full snapshot-restore-detonate cycle confirmed against a real customer-style guest VM, including a network-detection fix (connections are now polled throughout the monitoring window instead of checked once at the end) and a 6-step "Test Sandbox" diagnostic (VBoxManage found, VM found, snapshot found, guest auth works, real byte-for-byte copy-in/copy-out round trip, and a genuine snapshot-restore verification) - all 6 passed against the real guest VM in a live run.

Real per-country CIDR data downloaded from ipdeny.com (free, no account required) and wired into an actually-enforced Nginx geo map and Apache deny rules, confirmed via a real download and a real generated, syntax-checked config. This replaces a checkbox that previously saved a setting no config generator ever read.

Enforced on both Nginx and Apache since v14.8.0. RBAC gating was confirmed to have exactly 7 real call sites via direct code audit, not just a settings toggle.

Request rate and error rate are real, parsed directly from live Nginx access logs. Latency percentiles (P50/P95/P99) are honestly reported as "n/a" rather than fabricated - the access log format has no per-request timing field, so there's nothing to compute them from yet.

Scoring logic runs against real configuration state, but hasn't been independently audited against each framework's actual requirements checklist.

Real hook-based runtime since v14.5.0, with 6 working starter plugins. The hosted marketplace's plugin listing itself hasn't been independently re-verified this session.

Not independently re-verified this session; no evidence found of it being non-functional.

Not covered by this session's testing pass.