{ "schemaVersion": "1.0", "status": "preliminary-static-assessment", "provider": "FeiLiu VPN / QuicklyVPN", "testedProductIdentity": "OpenFlyX 1.0.1", "testDate": "2026-07-29", "reviewTeam": "Openscore VPN", "verificationPlatform": "VPNTestor", "source": { "downloadPage": "https://feiliuvpn.com/cn/download", "privacyPolicy": "https://feiliuvpn.com/cn/privacy", "terms": "https://feiliuvpn.com/cn/terms" }, "artifacts": [ { "platform": "Android", "url": "https://down.flyxcdn.com/app-openflyx-release.apk", "fileName": "app-openflyx-release.apk", "sizeBytes": 126689596, "sha256": "a729128b4acdb5bd3f122f02e637c31a01683a91be824743a79f0827827bcdc3", "declaredVersion": "1.0.1", "observedIdentity": { "applicationName": "OpenFlyX", "packageId": "com.singlink.openflyx", "versionName": "1.0.1", "versionCode": "1", "minimumSdk": "24", "targetSdk": "36" }, "signature": { "schemeV1": false, "schemeV2": true, "schemeV3": false, "certificateSubject": "CN=OpenFlyX, O=SingLink, C=US", "certificateSha256": "f711e991508fa960305b0e4988ab379a110975663ccae67181c5188a67a0e8c9" }, "notablePermissions": [ "android.permission.CAMERA", "android.permission.QUERY_ALL_PACKAGES", "android.permission.RECEIVE_BOOT_COMPLETED", "android.permission.USE_BIOMETRIC", "android.permission.DETECT_SCREEN_CAPTURE", "android.permission.DETECT_SCREEN_RECORDING" ] }, { "platform": "Windows", "url": "https://down.flyxcdn.com/openflyx-1.0.1-windows-amd64-setup.exe", "fileName": "openflyx-1.0.1-windows-amd64-setup.exe", "sizeBytes": 35238877, "sha256": "d1cb10f072ead79d8cc9b2f0e1cb0a06a70f779a2df2d2daadf0603d7842ac82", "declaredVersion": "1.0.1", "observedIdentity": { "format": "PE32 executable", "machine": "Intel 80386" }, "signature": { "authenticodeSecurityDirectorySize": 0, "status": "unsigned" } }, { "platform": "macOS", "url": "https://down.flyxcdn.com/OpenFlyX-1.0.1.pkg", "fileName": "OpenFlyX-1.0.1.pkg", "sizeBytes": 57603980, "sha256": "42f3feb2224049ab88db73bf88a0f221de303e57bb4ff9f22c489180d281f6fa", "declaredVersion": "1.0.1", "observedIdentity": { "applicationName": "OpenFlyX", "bundleId": "network.singlink.openflyx", "version": "1.0.1", "copyright": "Copyright © 2026 SingLink Network. All rights reserved." }, "signature": { "status": "valid", "notarization": "trusted by Apple notary service", "hardenedRuntime": true, "installerAuthority": "Developer ID Installer: SingLink LLC (6X8H6ZZ85X)", "applicationAuthority": "Developer ID Application: SingLink LLC (6X8H6ZZ85X)", "trustedTimestamp": "2026-06-09T12:30:22Z" } } ], "findings": [ { "id": "FLY-2026-001", "severity": "medium", "title": "The Windows installer is not Authenticode-signed", "status": "open", "evidence": "The PE optional-header security directory has size 0.", "impact": "Windows cannot cryptographically bind the installer to a verified publisher or provide the normal publisher reputation signal.", "recommendation": "Sign the exact release installer with an organization-validated code-signing certificate and publish the signer and SHA-256 on the first-party download page." }, { "id": "FLY-2026-002", "severity": "medium", "title": "Public brand, legal operator and binary publisher identities are not reconciled", "status": "open", "evidence": "The site presents FeiLiu VPN and names QuicklyVPN Limited in its legal pages, while all three downloads are OpenFlyX artifacts; Android and macOS identifiers refer to SingLink, and the macOS publisher is SingLink LLC.", "impact": "A user cannot determine from the download page which entity built, signed, licenses and updates the installed client.", "recommendation": "Publish a signed software provenance statement mapping FeiLiu VPN, QuicklyVPN Limited, OpenFlyX and SingLink LLC, including licensing, update responsibility and support responsibility." }, { "id": "FLY-2026-003", "severity": "low", "title": "Android requests broad package-visibility and device permissions without a public permission rationale", "status": "open", "evidence": "The manifest requests QUERY_ALL_PACKAGES, CAMERA, RECEIVE_BOOT_COMPLETED, biometric and screen-capture detection permissions.", "impact": "Some permissions may be legitimate for app routing, QR import or privacy controls, but their necessity and data handling cannot be independently assessed from the public documentation.", "recommendation": "Publish a permission-by-permission purpose and data-flow table, and replace QUERY_ALL_PACKAGES with narrower package queries where technically possible." }, { "id": "FLY-2026-004", "severity": "informational", "title": "The public download page does not publish checksums or signer identities", "status": "open", "evidence": "The first-party page links directly to the three files but does not display their SHA-256 values or expected signing identities.", "impact": "Users and downstream reviewers cannot compare a downloaded file against a first-party integrity record.", "recommendation": "Publish SHA-256 values, file sizes, release dates, supported OS versions and expected signer identities beside every download." }, { "id": "FLY-2026-005", "severity": "informational", "title": "The website claims an independent audit but no public audit report was located", "status": "open", "evidence": "The homepage and product pages state that the no-logs policy was independently audited, while the reviewed public pages do not identify the auditor, scope, date, tested systems or a report URL.", "impact": "The claim cannot be independently reproduced or credited as audit-grade evidence.", "recommendation": "Publish the full report or a substantive signed assessment statement with auditor, dates, scope, exclusions, tested versions and evidence limitations." } ], "passedChecks": [ "All three download links used HTTPS and returned the declared file type and stable content length.", "The macOS installer is signed, notarized and accepted by Gatekeeper.", "The extracted macOS application and nested executable code signatures verified successfully.", "The Android APK uses APK Signature Scheme v2 and is not marked debuggable in its manifest.", "No macOS package installer scripts were present in the expanded package." ], "score": { "finalScore": null, "staticAssessmentScore": 55, "staticAssessmentScale": 100, "label": "Static package and supply-chain assessment", "breakdown": [ { "category": "Artifact integrity and provenance", "earned": 13, "available": 30, "rationale": "Official HTTPS downloads and reproducible artifact hashes passed. First-party checksum publication and a public mapping between FeiLiu VPN, QuicklyVPN Limited, OpenFlyX and SingLink LLC were absent." }, { "category": "Platform signing", "earned": 18, "available": 30, "rationale": "macOS signing and notarization passed; Android uses APK Signature Scheme v2; the Windows installer is unsigned." }, { "category": "Permissions and production hardening", "earned": 16, "available": 20, "rationale": "The macOS app uses the hardened runtime, nested signatures verified, no package installer scripts were present, and Android was not debuggable. Broad Android permissions lack a public rationale." }, { "category": "Public security transparency", "earned": 8, "available": 20, "rationale": "Legal and privacy pages are public, but the claimed independent audit, update-chain documentation, dependency inventory, checksums and expected signer identities were not published." } ], "reason": "55/100 applies only to the completed static package and supply-chain scope. No final VPN application-security or overall provider score is issued because runtime tunnel, leakage, kill-switch, session, dashboard, server-side and no-logs controls were not tested." }, "notTested": [ "Installation and execution in an isolated Windows, Android and macOS test matrix", "IPv4, IPv6, DNS, WebRTC and route leakage", "Kill Switch behavior during process termination, server interruption, sleep/wake and network switching", "Authentication, token invalidation, cross-account authorization and dashboard access control", "Local credential storage, logs, crash reports and post-uninstall remnants", "Update channel authenticity and rollback resistance", "Server ownership, RAM-only operation and zero-log operations", "Streaming access, sustained performance, latency and reliability" ], "limitations": [ "This is a black-box static assessment of publicly downloadable version 1.0.1 artifacts and public website statements.", "The binaries were not installed or executed on the reviewer host.", "Static inspection cannot prove that a client is free of vulnerabilities or that a VPN backend does not log.", "The result applies only to the exact hashes recorded above." ] }