v1.11.1 — The release that actually contains the DLLs.

v1.11.1 — the release that actually contains the DLLs

Every finding from the third audit round: 6 critical, 30 high, plus the
security-relevant mediums. 1538 tests pass.

Critical

• Torrents leaked your real IP. The libtorrent session was created with no
  proxy at all. libtorrent ignores http_proxy and the Windows WinINET
  setting, so every tracker announce and peer connection went out over the raw
  uplink. It now forces SOCKS and refuses to start when nothing is listening
  on that port — a torrent can no longer quietly run unprotected.
• Saving over a library that failed to read is refused. A transient read
  error used to replace the whole saved config set with an empty list.
• The QoS shaper would have blackholed the machine. It opened a WinDivert
  handle for all packets and never re-injected them. It now refuses to open
  until a re-inject loop exists.
• IKEv2 can dial. It called Connect-VpnConnection, which is not a cmdlet
  (Windows ships Add/Get/Set/Remove-VpnConnection, nothing that dials). It
  uses rasdial now — the engine was dead on every host.
• Arrow keys work in POSIX terminals. Reading sys.stdin pulled the whole
  ESC [ A into Python's buffer, so select() on the fd saw nothing pending
  and every arrow arrived as a bare Escape.
• A setup backup can be restored. Export stripped exactly the credentials
  import required, so the roundtrip always failed.

High

• blackout dashboard exists and works. The module was imported by
  nothing, crashed on launch (rich.Live was handed a generator), and read
  state keys the daemon never writes. It renders in a loop now, derives
  connected/throughput from the keys that exist, and the daemon records a real
  start timestamp and process RSS.
• The whole OpenAPI document, not just the webhooks. Request imported
  inside create_app() plus from __future__ import annotations made FastAPI
  treat it as a query parameter: POST/DELETE /api/v2/webhooks returned 422
  and GET /openapi.json returned 500. The file's own comment predicted this
  for WebSocket and left Request alone.
• ss:// configs are imported. Shadowsocks links were missing from the
  parser's scheme list, so they were dropped silently even when a trusted
  source advertised them. Both share-link shapes are parsed, and sing-box gets
  a shadowsocks outbound with no TLS block.
• FAKE_SNI actually rewrites the ClientHello. The value was parsed and
  never used; the native engine's headline feature did not exist. The rewrite
  recomputes every enclosing length, with Go tests.
• TUN mode starts on current sing-box. It emitted inet4_address and
  inbound sniff, removed in 1.12/1.13, so the managed binary rejected the
  config at decode time.
• Every registered engine can be started and selected. The daemon's engine
  map and the settings validators were hand-maintained lists that had drifted
  apart; six engines could not be started and four could not be selected. Both
  derive from ENGINE_REGISTRY now.
• A verified binary update no longer bricks its engine. The downloader
  never re-pinned the manifest, so the next launch failed with "hash
  mismatch". The manifest also moved out of bins/ — the directory it exists
  to protect — and the in-process DLLs are hash-checked before loading.
• The release ships the DLLs. BIN_REGISTRY marks blackout_core.dll as
  required and no published release had ever contained it. Both DLLs are built
  and attached now.
• IP scanning no longer leaks C heap memory on every scan, works off
  Windows instead of returning an empty list, and no longer blocks the event
  loop.
• The web dashboard needs no CDN (it was blank on exactly the filtered
  networks this tool is for) and its live stream no longer stops after five
  events.
• Path traversal in the plugin marketplace and the download manager is
  closed, and a media URL can no longer become a yt-dlp option.
• The enterprise policy is enforced. Roles and permissions existed but
  nothing ever checked them. Every subcommand is gated and exits 3 when the
  active principal lacks the permission.
• The ad blocker imports the lists it recommends. It only understood hosts
  format, so an EasyList or a plain-domain list produced zero rules and still
  reported success.

Known limitations

• AmneziaWG, ShadowTLS and WARP parse and display but cannot connect: the
  bundled sing-box core has no engine for them. They are no longer offered as
  connectable, so they fail honestly at selection.
• The QoS shaper refuses to open a divert handle until a re-inject loop exists.
• psiphon_http_port is not used: the native engine serves SOCKS only.

Assets

File	What it is
blackout.exe	Standalone Windows CLI
blackout_core.dll	In-process core (SNI, XRay, GDPI, WireGuard, scanner)
blackout_warp.dll	WARP / Psiphon engine
blackout-core-windows-amd64.exe	Supervised daemon
blackout-engine-linux-amd64	Linux runner
blackout-core-linux-amd64	Linux core daemon
blackout-source.zip	Source tree
checksums.txt, blackout.exe.sha256	Digests