zorven
EN
TürkçeEnglish日本語
Sign in Start free
Release 0.2.29 - 0.2.32

Zorven 0.2.29 - 0.2.32: Zorven Apps runs your apps on your own machine, bot protection, trusted IPs and paginated lists

A summary of releases 0.2.29 through 0.2.32. Your client updates automatically; to update by hand run zorven update. The desktop app and the CLI ship together with the same version number.

Zorven Apps: your app on your own machine, managed from Zorven

  • Run it on your own server: publish a Docker image or a Git repository with zorven deploy. Containers run on your machine (the device running the Zorven client), and your data never leaves it.
  • Automatic tunnel and HTTPS: the tunnel and address for your app are created for you; you can also attach a custom domain.
  • Zero-downtime updates: with blue/green switching, traffic moves to the new version only after it passes its health check. If something goes wrong, roll back with one command (zorven apps rollback).
  • Live logs and status: in the panel and with zorven apps logs -f.
  • Secret Vault: write {{secret:name}} in environment variables; the value is resolved only at deploy time and masked in the panel and logs.
  • GitHub integration: automatic deploys on push and a preview environment per pull request.
  • Limited keys for CI: an API key with the apps:deploy scope can only deploy.
  • Claude and MCP: tools to list apps, read logs and deploy. Removing and rolling back require explicit confirmation.
  • Safe defaults: ports are published to 127.0.0.1 only, there is no privileged mode, and Linux capabilities are dropped. The tunnel WAF, bot protection and access policies apply to your app as well.
  • To get started: run zorven --enable-deploy on the device (as a service, zorven up --enable-deploy), then zorven deploy init and zorven deploy --wait. The panel has a new Apps page.

Security

  • Trusted IPs: a per-tunnel list of IPs or CIDRs (up to 100) that skip the WAF, bot verification and rate limiting, and optionally country rules too. Access rules still apply. You can add one with a single click from a blocked request.
  • Bot challenge page: the verification page gains a trace circling the shield, a pulse ring and a checkmark on success (respects the reduced-motion preference).
  • CAPTCHA: now also applied to password reset requests.
  • MCP confirmation: when Claude creates or updates a tunnel, sensitive targets (management ports such as SSH, RDP and databases, and private network addresses) require explicit confirmation.
  • Web door: the door link now only opens a confirmation page; you must click the confirm button to open the door. Bots that preview links can no longer open it.
  • Unsubscribe links expire after one year.
  • UDP: default packet-rate limits per flow and per tunnel; excess packets are dropped and counted.
  • Stricter Content Security Policy (CSP) and peer verification on the client's local control channel.

Panel

  • All lists are paginated: 50 records per page with previous/next and page numbers; search and filters work together with paging.
  • Live requests follow the selected project: the request list on Overview and the live stream, rejected requests included, are filtered to the project you picked.
  • Tunnel MCP tab: fixed the tab staying blank before any calls had been made.
  • Private network: a new "How it works" card.
  • A notice about screen sharing for a client running as a Windows service.

Client

  • CLI in three languages: all output, help and error messages in Turkish, English and Japanese. Choose the language in zorven settings; if unset, the environment/OS language is used.
  • Desktop language setting: pick TR/EN/JA in Settings, no restart needed.
  • zorven up: upgrades an old systemd unit, and on Windows elevates itself via UAC when privileges are needed (disable with --no-elevate).
  • Screen sharing: DXGI capture is now the default on Windows (it falls back to the previous method automatically if it fails). Screen sharing also works while the client runs as a Windows service; a small helper process runs in your user session.
  • H.264 video mode: switches automatically on fast-moving content and adapts the bit rate to what the viewer actually receives. On Windows a hardware encoder is used when available.

Performance

  • Faster WAF: a new pre-filter makes WAF checks on clean requests roughly ten times faster.

← All updates