The tracker catalogs published independent audits for 71 VPN providers, last checked November 9, 2026. It counts 23 providers with at least one qualifying audit and 48 with none published; 30 audits took place in the preceding 24 months. Each listing gives the latest audit date, auditor, examined areas and a link to documentation, while also indicating how many audits the provider has had. Recent examples include iVPN, whose latest listed audit was by Cure53 on November 9, 2026, and Mullvad, audited in June 2026 by a range of firms. ExpressVPN has 22 listed audits, the highest count shown.
The tracker distinguishes audits of no-logs claims from reviews of apps, infrastructure and broader security, making clear that providers’ audits do not all test the same things. It counts only work supported by a dated publication from the provider or auditing firm; an “audited” badge or unsupported policy statement is not enough. Audit histories also vary considerably: PureVPN’s latest listed audit dates to 2021, while VyprVPN’s dates to 2018. The listings therefore help compare the existence, recency and scope of documented audits, but an audit of one area should not be read as a review of every aspect of a VPN service.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.