esefxdzandClaude Opus 5
f26c459f6c
The migration write is best-effort again. `_mode` is already the safe TUN default in memory by the time it runs, so a failed write leaves nothing insecure -- it only means the migration is retried on the next launch. Throwing there was a startup brick rather than a fail-closed guard. `initialize()` is awaited from `main()` at lib/main.dart:19, before `runApp()`, with no try/catch and no `runZonedGuarded`; `FlutterError.onError` and `PlatformDispatcher.onError` are installed later and would not catch it either. The branch also runs on every fresh install, since `storedMode` is null and `null != 'tun'`. A `setString` returning false would therefore have meant a black screen with no error UI, repeating every launch, in exchange for no security benefit. Also restores two comments this PR removed from code it does not otherwise touch -- the `_reconnect` note on why the repair path shows no rewarded ad, and the explanation of how an orphaned proxy outlives the app process -- and drops a stray 'ass' from the legacy-values comment. The `setMode` half of the PR is unchanged: persisting before mutating memory and surfacing failures to the UI is the right behaviour. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_019HT2x2JvJNg7XNsJubfHFf
ReVoltVPN
A free VPN app for Android. Open-source client, transparent infrastructure. Watch an ad, get 2 hours of full-speed traffic — no accounts, no logs, no subscriptions.
How it works
- Watch a short rewarded ad
- Server creates a temporary VLESS session (2 hours / 10 GB)
- Your traffic routes through a single server in Finland at full speed
- When time or data runs out, session ends — watch another ad to continue
- No throttling, no slow lane, no mid-session punishment
No email. No password. No payment. The ad pays for the server.
Protocol
- Transport — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind
/revolt) - Obfuscation — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website
- Encryption — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required
- API — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only
Stack
| Layer | Technology |
|---|---|
| App | Flutter (Android) |
| VPN | VLESS + Xray Reality + XHTTP |
| Backend | Python Flask ("Hivemind") — session management, quotas, stats |
| Ads | Google AdMob rewarded, verified server-side |
| Server | Debian, single Hetzner box in Finland |
Limitations
- One server, one location (Finland)
- 2 vCPU / 4 GB RAM — not built for thousands of concurrent users
- Android only
Privacy
Your traffic routes through Finland. We don't log it, inspect it, or sell it. Hivemind tracks only session liveness and byte counters for quota enforcement — no packet contents, no destination IPs, no DNS queries.
Full privacy policy: PRIVACY_POLICY.md
ReVoltVPN is not affiliated with any VPN company.