Vault DM
What the servers can and can’t see
Vault DM has two small servers. The relay holds mail and the public forum. The mail server sends email codes. This page lists what each one stores, written as if someone had taken them.
The relay
| It has | It does not have |
|---|---|
| Usernames and mailbox ids | Your private messages |
| When mail arrives and how much, in padded sizes | Community channel messages |
| A PIN check, so it can tell a right PIN from a wrong one | Your PIN or your vault key |
| Public forum posts and replies | Your email address |
| Community names, members, and roles | Your IP address (you reach it through Tor) |
Logging in correctly on the relay does not unlock old messages. They only open on the PC that has the vault file.
The mail server
It keeps email addresses, each next to a random id, and it can send a code to them. That is all it does. It does not have vault keys, and it is a separate server from the relay, so neither one has both your username and your address.
Anyone who can read your email can use a reset code to set a new PIN and keep using your username. They still cannot open your old messages. If that matters to you, use the verification board instead of email.
On your PC
The vault key is random and created on your PC. It is locked by your PIN, then sealed by the TPM, and on Windows also by your Windows account. Someone who copies the vault file to another computer gets nothing they can open.
Vault DM can’t protect you from malware already running as you on that PC. Nothing can. Keep the PC itself up to date.
This website does not run PHP
PHP2Shell is the name for two bugs in PHP (CVE-2026-109618 and CVE-2026-109619) that let a single web request run code on a server with unpatched PHP. They are fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
This site is plain HTML files served by a small Go program, which also takes the report form. There is no PHP on the server at all, and requests for .php files are turned away. The relay and the mail server are Go programs too, so the bug does not reach them either.
Reports sent through the form keep what you typed and the time. Your IP address is not saved.
Downloads
Every download has a fingerprint on the download page so you can check your copy wasn’t changed. The Tor in the Windows download is the Tor Expert Bundle 15.0.26 from torproject.org, checked against the Tor Project’s signature before it was packed.