how veil actually works

checks

Every check is read-only. veil inspects live system state — resolver config, active network interfaces, firewall ruleset, disk encryption status — and reports one of four results: ok, warn, fail, or unknown.

unknown is a distinct result from fail. If a probe can't determine an answer — an unfamiliar init system, a firewall frontend it doesn't recognize — it says so rather than guessing. Reporting "we couldn't tell" as "you're unprotected" is exactly the kind of false confidence this tool exists to avoid.

The eight checks: encrypted DNS, VPN tunnel, traffic egress, firewall, IPv6 leak guard, MAC randomization, encrypted messaging, disk encryption. See the full list with why-it-matters copy on the main page.

fixes

A fix is a specific, named remedy for a specific failing check — never a vague "harden your system" action. veil detects your init system (systemd, OpenRC, runit, s6, dinit) and package manager (apt, dnf, pacman, emerge, zypper, apk, xbps, nix) before producing a command, so the command it shows targets your actual machine.

If the init system or package manager can't be identified confidently, veil returns plain-English instructions instead of a command that might be wrong for your setup — never a best-guess command dressed up as certain.

free vs plus

Free: every check, every score, plain-language reasons for every gap, and the fix commands for the simplest, safest issues — encrypted DNS, MAC randomization, encrypted messaging — run yourself, no automation.

Plus (one-time payment): the remaining fix commands (VPN tunnel, traffic egress, firewall, IPv6 leak guard, disk encryption), one-click apply through a privileged helper, an always-on guardian that alerts when protection drops, auto-heal, deep leak and kill-switch stress tests, hardening profiles, posture history, and config backup. See pricing for the exact list.

licence keys

Plus is unlocked with an offline licence key, issued by hand after a crypto payment (see the checkout flow). The key is verified locally against a signature baked into the app — there is no server call, no phone-home, no periodic re-check. Once validated, plus keeps working with no further connection.

This is honor-system light-DRM, not heavy copy protection: the verification logic lives in the app itself, so a determined reverse-engineer could extract it. That trade buys zero server, zero account, and zero telemetry — the priorities in that order, on purpose.

platforms

Linux and Windows only. See the linux page and the windows page for what each check does per platform, including where Windows answers a narrower question than Linux (MAC randomization policy, specifically).

reverting a fix

Every applied fix is reversible. veil can generate a commented, revert-everything shell script plus a plain-text how-to into your documents folder — it reverts only what veil itself touched, nothing else on the system.