Your subscription link is a password
One subscription URL pulls down the address, port and password of every node you have. Dropping it into a group chat for help, putting it in a screenshot, pasting the config into an online YAML validator: all three hand your account to someone else.
When you genuinely need another person to look at your config, strip the link and the server and password lines out of the proxies block first. What is left, the rules and the proxy groups, is enough to diagnose almost anything.
Online YAML tools are the easy one to forget
Whatever you paste there stops being yours, and plenty of those sites keep logs.
Three doors that face outward
- 1
Keep the controller port on localhost
The external controller listens on 9097 by default, or 9090 on installations that go back far enough, and exists so third-party dashboards and command line tools can reach the core. Bound to 127.0.0.1 it is fine. Change it to listen on every address without setting a secret and anyone on the same network can switch your nodes and read through your connection list. If you do need remote access, fill in the secret in the same sitting.
- 2
Turn the LAN switch back off
Allowing LAN connections exists for the phone or the TV sitting next to you. There is no login behind it. Its entire security rests on the assumption that only people on your own network can reach the port, and in a cafe, an airport or a hotel that assumption is false.
- 3
debug level records the domains you visited
Raising the log level to debug while chasing a problem is the right call, but every DNS query and every connection lands in the file, and that adds up to a browsing history. Once the problem is solved put it back to info and clear the log files while you are there. Read a log yourself before you send it to anyone.
The last pass before you walk away
Before quitting, confirm the system proxy is off. It writes into the proxy settings of the operating system and points them at 127.0.0.1:7897, or 7890 on older installations. Close the program with that entry still in place and the next person at this machine finds that no browser opens anything. On a shared computer this is the one to check twice.
- Take installers only from github.com/clash-verge-rev/clash-verge-rev/releases
- Encrypted DNS in the browser walks around the whole resolution setup you built, so switch it off
- WebRTC can expose your real address directly, so test it before you rely on the connection
Common questions
I sent my subscription link to the wrong place. Can I undo that?
Sign in to the provider panel and look for the option to reset the subscription address, sometimes labelled as resetting the token. The old link dies the moment you reset it, so whoever holds it gets nothing. Then delete the old profile in Clash Verge and import the new address. If the panel has no such button, contact support: changing your account password on its own usually does not invalidate the link.
Does the log file contain anything private?
At info level you mostly get connections opening, rule matches and error messages. Domains appear, but not exhaustively. debug level is a different file altogether: DNS queries and the destination of every request are all in there. So before sharing a log, either set the level back to info and reproduce the problem once more, or read the file through and take out the domains and node addresses by hand.