APP REVIEW · APP 03

VPN TP

Apple ID 6806803997 · Bundle ID com.vpntp

2026-09-12 整理 · 通知前后由开发者提供的状态：1.0.2 等待审核
Developer-reported circumstances around the notice: 1.0.2 waiting for review. Not a current availability check.

这些材料记录本机源码摘录及既有说明，尚未建立其与 Apple 已接收二进制的对应关系。没有把正式构建录屏、后台提交记录、实际网络抓包或整改写成已经完成。官网已有展示素材是功能导览，不自动作为历史发行 Build 的证据。

These materials record selected local source and existing local documents, not a verified match to binaries received by Apple. Distribution-build recordings, backend submission records, runtime traffic captures and remediation are not represented as completed. Existing website showcase media is a product guide, not automatically evidence of a historical distribution Build.

简体中文

功能与实现

D02 将 App 描述为配置文本工具，而非开发者运营的 VPN 连接服务。S09 有普通设置页可见的样例入口；S05、S06 的测试参数可跳过广告配置、引导或载入样例。部分入口未受 DEBUG 包围，需要对应实际上传 Build，不能把局部源码当成整个发行二进制审计。

联网用途与边界

S07 直接向用户指定的 HTTPS 地址请求文本。S08 实现 DNS、TCP 与 TLS 检查；移动版另有 Google 广告。这些是对外网络活动，使用 Apple API 不代表请求目标是 Apple。S06 的保留示例域名与样例字符串不代表实际节点服务。

复现步骤（尚待对应构建录屏）

不带测试参数正常启动，打开设置中的本地样例。
展示本地编辑、校验及转换，再导入本人有权访问的 HTTPS 配置源。
主动执行诊断并说明目标；对录屏和网络记录中的真实令牌、私钥及节点凭据脱敏。

待补充证据

需核验实际签名 entitlement、所有嵌入扩展、普通启动行为与 1.0.2 Build。此材料不请求 VPN 或地区规则豁免。

English

Functionality and implementation

D02 describes a configuration-text utility rather than a developer-operated VPN connection service. S09 exposes samples in normal Settings; test arguments in S05–S06 can bypass ad configuration/onboarding or load samples. Some entries are not DEBUG-guarded and must be matched to the uploaded Build. Selected source is not a full distribution-binary audit.

Network purposes and boundaries

S07 downloads text directly from a user-selected HTTPS URL. S08 implements DNS, TCP and TLS checks; the mobile app also has Google advertising. These are internet operations: Apple APIs do not make their destinations Apple services. Reserved example domains and sample strings in S06 are not a working node service.

Reproduction steps (Build-matched recordings still required)

Launch without test arguments and open local samples in Settings.
Demonstrate local editing/validation/conversion, then import an authorized HTTPS configuration source.
Initiate a diagnostic and identify its target; redact real tokens, private keys and node credentials in recordings and traffic logs.

Evidence still required

Still required: signed entitlements, all embedded extensions, normal-launch behavior and the 1.0.2 Build. This material does not request exemption from VPN or regional rules.