Privilege
The signed host service runs under a dedicated service identity with bounded Linux capabilities. The local agent, not a browser or Node.js app, owns host grants and kernel changes.
Loading HoneyMesh...
Loading HoneyMesh...
Security review
HoneyMesh separates application observations, operator requests, host authorization and packet effects. These are the controls to examine before granting a security service access to a Linux host.
The signed host service runs under a dedicated service identity with bounded Linux capabilities. The local agent, not a browser or Node.js app, owns host grants and kernel changes.
The host console and management API bind to loopback. Remote administration uses an operator-controlled tunnel, local TLS trust, and an admin credential. Keep the provider console available for recovery.
Node Guard Free evaluates locally. The optional Node Pro bridge authenticates a registered application and checks its grant scope before the host agent decides whether to act.
Host grants have an owner and bounded expiry. Release, reconciliation, TEST mode, and the emergency rollback path are part of the operator workflow.
Paid host candidates use signed manifests, publisher identity, file hashes, and a pinned archive hash. Verify the exact release record and installation guide before use.
Exchange and peer trust are opt-in. A receiving host must make its own authorization decision. The distributed lifecycle is still a separate private pilot.
The product is designed for local operation. Purchase and optional sharing are separate data paths; a promise that no data ever leaves the host would be inaccurate.
Socket and interface metadata, events, policy decisions, grants and console credentials remain in the local deployment unless an operator configures export or sharing.
Checkout, subscription state, contact email and license fulfillment require the payment and delivery services described in the privacy policy.
Exchange may transmit selected security signals to trusted peers only when an operator enables and configures it. Review its separate pilot scope before using it.
Published evidence is vendor-run and version-specific. The tested host profile is noncritical Ubuntu 24.04 AMD64 with generic XDP and selected ingress interfaces. It does not prove broad detection accuracy, full egress or stateful firewall coverage, independent certification, or production readiness.
Inspect methods and limitsSend a concise report, affected version, reproduction steps and potential impact to Admin@Network-Decode.com. Avoid sending private keys, customer traffic or exploit data in the initial email. Request a secure transfer route if needed.
Response times and security certifications are not represented here as contractual commitments.