How we look after the appliance you put on your network.
Shield is a piece of hardware that sees a lot of your traffic. We treat that responsibility seriously, both in how the device is built, and in how we handle reports when something is wrong.
Reporting a vulnerability
If you believe you've found a security issue in WOMBATS Shield, the appliance, the local web management UI, the update path, or anything bundled with it, please tell us. We'll respond like adults: quickly, privately, and with credit in the update notes if you want it.
- Email: security@wombatss.com
- Acknowledgement: within 2 business days of your report.
- Triage: within 7 business days.
- Status updates: after acknowledgement we will update you on progress at least every 14 days until the issue is resolved, and we will tell you when a fix ships and which update carries it.
- What we need from you: a way to reply — an email address is enough. We don't ask for your name or any other personal information, and reporting is free.
We will not pursue good-faith researchers who follow this disclosure path. Please give us a reasonable window to investigate before public disclosure. This covers the appliance's hardware, the software it ships with, and the software we provide to use it. A machine-readable copy of this contact is at /.well-known/security.txt.
Security updates until at least 31 December 2029
Every WOMBATS Shield — its hardware and the software it ships with — will receive all available security updates until at least 31 December 2029. We will never bring that date forward. We review it every year and, when we extend it, we publish the new date here.
A security update is a software update that protects or improves the security of your Shield, including one that fixes an issue found by us or reported to us. Updates arrive as signed bundles that your Shield verifies before applying — see Update philosophy below. There is no first-party app to keep updated: Follow-Me Filtering uses the free WireGuard app, which its own makers maintain.
Changes to this date
- 29 September 2026: Support period published: security updates until at least 31 december 2029.
What's in the appliance
Shield is built on trusted open technology, hardened and tailored into a real appliance. We'd rather tell you what's underneath than pretend we wrote it all from scratch.
Raspberry Pi 5 hardware baseline+
Shield runs on the Raspberry Pi 5, a single-board computer, and it is the same board across Core, Edge and Vault. Real, repairable, well-documented hardware with a long supply life, not a one-batch custom board.
Debian 12 base system+
A long-term-support Linux base with a known security track record and a predictable patch pipeline. We track upstream Debian security where relevant.
AdGuard Home, hardened baseline+
Shield uses AdGuard Home as its DNS-layer filtering engine. We've intentionally restricted, disabled or redesigned features that conflicted with our privacy and security goals, including default query logging behaviour, remote-management exposure, and any ambiguous telemetry. AdGuard provides the engine. Shield's appliance behaviour is ours.
nftables enforcement+
Shield applies local nftables redirect, port-block and forward-chain rules to resist common DNS-bypass paths and Apple Private Relay traffic. Enforcement happens on the device, not on a vendor cloud.
Signed software updates+
Software bundles are signature-verified before they're applied. There is no ad-hoc file replacement, no remotely pushed unsigned change. The update path is the only way new code lands on Shield.
Hardware-assisted unlock+
Shield's encrypted partitions are unlocked at boot through a hardware-assisted key path burned into the board's own one-time-programmable silicon. The unlock key is bound to the device, it can't be lifted off and used elsewhere — there is no master key across the fleet, not even for us.
Vault SSD, three unlock paths by design+
Shield Vault's SSD, with encryption switched on when you first set up the drive, is designed around three unlock paths. (1) An auto-unlock key bound to the device's own silicon, used at boot so the SSD comes up cleanly on your network without prompting. (2) A user passphrase, for user-level access. (3) An off-device recovery key the system generates for you to save, for break-glass recovery if both of the above are unavailable. Lift the SSD into another machine and it stays dark, the auto-unlock key is bound to the original Shield.
Separate payload and storage partitions+
On Shield Vault, the encrypted payload partition that runs the system is kept separate from the encrypted storage partition that holds your files. Each is unlocked through its own silicon-bound key path. A failure or a reset on one does not threaten the other.
Update philosophy
We update Shield deliberately, not constantly. New software lands as a complete, signed bundle that is verified before it's applied. We don't silently push unrelated changes through a back channel, and we don't use the update path to add new telemetry. If we ever need to change what Shield does in a meaningful way, you'll hear about it before the change ships.
What we don't do
- Vendor cloud control plane, we don't have one. Filtering and management stay on Shield.
- Telemetry pipeline, we don't collect browsing history, query logs, or behavioural profiles back to us.
- Remote control by us, there is none: no vendor cloud control plane, no vendor account. Software from us arrives only as signed bundles your Shield verifies before applying.
- Required activation, Shield does not need to phone home to keep working.
Looking for the deeper architecture? See Privacy & security and how it works.