On 29 July 2026, the Openscore VPN team downloaded the three installers linked by feiliuvpn.com and performed a non-executing static assessment. The files identify themselves as OpenFlyX 1.0.1, not as a separately built FeiLiu VPN client. This report records what the public artifacts prove and leaves runtime security unscored.
The complete machine-readable evidence record, including exact hashes, file sizes, certificate identities, permissions, findings and exclusions, is available as JSON evidence.
Scope and frozen artifacts
- Android:
app-openflyx-release.apk, 126,689,596 bytes, SHA-256a729128b…27bcdc3. - Windows:
openflyx-1.0.1-windows-amd64-setup.exe, 35,238,877 bytes, SHA-256d1cb10f0…7842ac82. - macOS:
OpenFlyX-1.0.1.pkg, 57,603,980 bytes, SHA-25642f3feb2…281f6fa.
All three links were taken directly from the first-party FeiLiu VPN download page and delivered over HTTPS from down.flyxcdn.com. The assessment did not install or execute unknown code on the reviewer workstation.
Product and publisher identity
The public-facing identity is fragmented. The Chinese site calls the service FeiLiu VPN; its privacy policy and terms name QuicklyVPN Limited as the Hong Kong operator; the downloads are named OpenFlyX; Android uses package ID com.singlink.openflyx; and macOS uses bundle IDnetwork.singlink.openflyx with code signed by SingLink LLC. This does not by itself prove malicious behavior, but it prevents a user from determining which entity builds, licenses, signs and updates the installed software.
Platform findings
macOS passed the available static supply-chain checks. Apple reports a trusted Developer ID Installer signature, a trusted notary ticket and a trusted timestamp. Gatekeeper accepted the package. The extracted app and nested executables passed strict code-signature verification and use the hardened runtime. No package installer scripts were present.
Android has a valid v2 APK signature but broad permissions. The APK is OpenFlyX 1.0.1, targets SDK 36 and is not marked debuggable. It requests camera access, visibility of all installed packages, boot completion, biometric access and screen-capture detection. Some may support QR import, per-app routing and privacy controls, but the public documentation does not provide a permission-by-permission data-flow rationale.
The Windows installer is unsigned. Its PE Authenticode security directory has size zero. Windows therefore cannot bind this file to an authenticated publisher. The provider should sign the exact release and publish the expected signer and SHA-256 beside the download.
The claimed independent audit is not public evidence
FeiLiu VPN states that its no-logs policy was independently audited and that its servers are RAM-only. The reviewed public pages did not identify the auditor, engagement date, scope, tested systems, exclusions or a report URL. Those statements remain vendor claims and receive no audit-grade credit in this assessment. Client package inspection cannot verify backend logging or server storage.
Open findings
- Medium: unsigned Windows installer.
- Medium: FeiLiu VPN, QuicklyVPN Limited, OpenFlyX and SingLink LLC identities are not publicly reconciled.
- Low: broad Android permissions lack a published purpose and data-flow table.
- Informational: the download page omits checksums, file sizes and expected signing identities.
- Informational: the claimed independent no-logs audit is not accompanied by a public report or substantive signed statement.
Static assessment score: 55/100
- Artifact integrity and provenance: 13/30.
- Platform signing: 18/30.
- Permissions and production hardening: 16/20.
- Public security transparency: 8/20.
The largest deductions are the unsigned Windows installer, the unresolved relationship between the public brand, legal operator and binary publishers, the absence of first-party checksums and signer documentation, and the lack of a public report supporting the claimed independent audit.
Why this is not the final VPN score
VPNTestor's published methodology forbids silently awarding points to untested or blocked controls. A defensible final score requires isolated execution across the supported platforms, connection lifecycle and failure tests, IPv4/IPv6/DNS/WebRTC leak observations, Kill Switch tests, local-storage review, account and dashboard authorization checks, update verification and regression testing. Operational evidence is also needed before a zero-log or RAM-only claim can be verified.