Trusted Email & 6-Digit OTP Gate
All accounts must verify ownership of an established email provider (Gmail, Outlook, iCloud, Proton, Yahoo) via a 6-digit cryptographic OTP before creating tunnels. Over 3,500 disposable mail domains are blocked.
TRUST, SECURITY & ABUSE CENTER
Engineered for zero-trust safety.
Warren enforces strict identity verification, automated brand-impersonation blocking, and protocol-level safeguards to keep our relay network clean and trusted.
Subdomain Brand Guard
Our control plane automatically rejects tunnel subdomains containing financial, authentication, or brand-impersonation keywords (e.g., PayPal, Microsoft, Apple, banking, or login terms).
First-Visit Browser Interstitial
Free-tier HTTP endpoints display an explicit security warning to human browsers on first visit, preventing credential phishing while allowing webhooks and CLI tools to pass cleanly.
Network & SMTP Abuse Controls
Ports 25, 465, 587, and 2525 are blocked across all relay nodes, ensuring Warren tunnels can never be used for unsolicited bulk email or spam relay.
Rustls TLS 1.3 & Argon2id
All control and data streams use memory-safe Rustls TLS 1.3 encryption over Quinn 0.11 QUIC. Account passwords are hashed with Argon2id (64 MiB memory cost).
Sliding-Window Rate Limiting
Every endpoint is protected by per-IP sliding-window request rate limiters and daily bandwidth circuit breakers to stop DDoS amplification and scraping.
Report Abuse (< 2-Hour Takedown SLA)
If you suspect a *.warrentunnel.online subdomain is being used for phishing, malware distribution, or terms-of-service violations, report the full URL immediately to:
- Abuse Desk: abuse@warrentunnel.online
- Security & Support: security@warrentunnel.online / support@warrentunnel.online
Our Trust & Safety system investigates all abuse reports 24/7 with a target takedown SLA of under 2 hours, immediately revoking the offending tunnel token and banning the associated account.
Responsible Vulnerability Disclosure (RFC 9116)
Security researchers may inspect our machine-readable RFC 9116 manifest at /.well-known/security.txt. Please send vulnerability reports with reproduction steps to security@warrentunnel.online. We acknowledge reports within 24 hours and do not pursue legal action against good-faith security research.