Hello, I’m a tech executive at UFO VPN, and I want to begin by apologizing for the incident that occurred in 2020.
During that period, we failed our users. The data exposure was real. It resulted from allowing a third-party SDK to emit runtime logs, combined with a misconfigured server-side logging system that was accessible without authentication. That architecture should never have existed, and the criticism we received at the time was entirely justified.
I deeply regret that we put users in that position. I also understand that no explanation can undo the harm that was done. Still, once the severity of the issue was fully understood, it became critical to make fundamental changes and to be clear about what those changes were.
All client-side and server-side connection logging was disabled, including debug and development logs.
Sensitive fields were removed at the data-structure level so they cannot be recorded, even unintentionally.
The logging pipeline was rebuilt to require authentication, with strict least-privilege access controls and encryption applied both in transit and at rest.
Additional safeguards were added to the CI/CD pipeline so that any attempt to reintroduce connection-related logging is automatically blocked.
Today, user connection data cannot be accessed through internal APIs for a simple reason: it is no longer collected. This does not make past mistakes acceptable, but it reflects the seriousness with which this failure has been treated.
I am sharing this solely to take responsibility and to be transparent about what was learned. I am also willing to answer technical questions or listen to any concerns.
During that period, we failed our users. The data exposure was real. It resulted from allowing a third-party SDK to emit runtime logs, combined with a misconfigured server-side logging system that was accessible without authentication. That architecture should never have existed, and the criticism we received at the time was entirely justified.
I deeply regret that we put users in that position. I also understand that no explanation can undo the harm that was done. Still, once the severity of the issue was fully understood, it became critical to make fundamental changes and to be clear about what those changes were.
All client-side and server-side connection logging was disabled, including debug and development logs.
Sensitive fields were removed at the data-structure level so they cannot be recorded, even unintentionally.
The logging pipeline was rebuilt to require authentication, with strict least-privilege access controls and encryption applied both in transit and at rest.
Additional safeguards were added to the CI/CD pipeline so that any attempt to reintroduce connection-related logging is automatically blocked.
Today, user connection data cannot be accessed through internal APIs for a simple reason: it is no longer collected. This does not make past mistakes acceptable, but it reflects the seriousness with which this failure has been treated.
I am sharing this solely to take responsibility and to be transparent about what was learned. I am also willing to answer technical questions or listen to any concerns.