1. How connections are protected
Orylin uses HTTPS and WebRTC encryption, protects connection setup with your invitation, and limits use of service resources. Session content is not stored persistently, and the main site does not load third-party challenge scripts.
Messages, files and Direct voice use AES-256-GCM encryption with keys derived for each connection; files are also checked with SHA-256. The current design does not provide forward secrecy or post-quantum end-to-end encryption.
2. What to know before using Orylin
Orylin is not anonymous. Peers and network providers may see information needed to connect, and connection availability depends on the network. Orylin has not completed an independent security audit, so do not rely on it for emergency or high-risk communications.
Volunteer relay only forwards supported, single-hop encrypted data. It cannot read message content and is subject to service capacity limits.
3. Responsible disclosure
Security reports may be sent to support@orylin.link and should include the affected version, a minimal reproduction, expected impact and safe evidence, but never real user content, a complete invitation, session keys, raw SDP or ICE, IP addresses or reusable production credentials.
Do not publish exploitable details or send sensitive material through public posts or third-party chats.
4. Testing
Changes are checked before release with automated tests and browser-based connection tests.
These checks help find problems but cannot guarantee security on every device or network.