esefxdzandClaude Opus 5
e67f0b93ee
The client never called /session/stop - the string appears nowhere in lib/ or local_packages/, on this branch or on main - while the server has implemented the route all along (hivemind/api.py:237) and AGENTS.md rule 33 documents its ordering. Across a full device test session, two user disconnects and several expiries, the control plane logged zero calls. So a disconnect left the VLESS client provisioned in the Reality inbound and the session dict in memory and sessions.json until its window ran out. Anyone holding that UUID could keep tunnelling for the remainder. Users were not locked out of their quota - _handle_main replaces the session with a fresh full-length one on the next connect - so this is hygiene rather than a user-facing bug. Only SessionTimer.disconnect() calls it, which is reached only from the connect button. Expiry, the hard cap and a server-ended session are already gone server-side, and the route takes nothing but a device_id as proof of ownership, so no error path may reach it. Unawaited and capped at 3 s, so an unreachable API cannot delay the teardown, and every failure is swallowed: the session expires on its own regardless. Verified against a mock control plane: user disconnect POST /api/session/stop -> session removed expiry no call; alert still posted Co-Authored-By: Claude Opus 5 <[email protected]>
ReVoltVPN
A free VPN app for Android. Open-source client, transparent infrastructure. Watch an ad, get 2 hours of full-speed traffic — no accounts, no logs, no subscriptions.
How it works
- Watch a short rewarded ad
- Server creates a temporary VLESS session (2 hours / 10 GB)
- Your traffic routes through a single server in Finland at full speed
- When time or data runs out, session ends — watch another ad to continue
- No throttling, no slow lane, no mid-session punishment
No email. No password. No payment. The ad pays for the server.
Protocol
- Transport — VLESS over XHTTP (HTTP/2 multiplexed, path-hidden behind
/revolt) - Obfuscation — Xray Reality spoofs a real website's TLS. To any DPI box, your tunnel looks like a browser visiting that website
- Encryption — TLS 1.3 with borrowed certificate (Reality). No certbot, no domain ownership required
- API — Standard HTTPS to a separate domain. Tunnel destination is IP-pinned — domain compromise is DoS only
Stack
| Layer | Technology |
|---|---|
| App | Flutter (Android) |
| VPN | VLESS + Xray Reality + XHTTP |
| Backend | Python Flask ("Hivemind") — session management, quotas, stats |
| Ads | Google AdMob rewarded, verified server-side |
| Server | Debian, single Hetzner box in Finland |
Limitations
- One server, one location (Finland)
- 2 vCPU / 4 GB RAM — not built for thousands of concurrent users
- Android only
Privacy
Your traffic routes through Finland. We don't log it, inspect it, or sell it. Hivemind tracks only session liveness and byte counters for quota enforcement — no packet contents, no destination IPs, no DNS queries.
Full privacy policy: PRIVACY_POLICY.md
ReVoltVPN is not affiliated with any VPN company.