What's proven

Flarebox covers a lot of Cloudflare, and not all of it has run against a real account. This page says which parts have. As of 2026-10-16.

Released

• pqdoctor v0.1.0 released (2026-10-15): the Windows CLI on Downloads, with its SHA-256, and the crate on crates.io. Not code-signed.
• pqdoctor for Linux and macOS (2026-10-15): static Linux binaries (x86_64, arm64) and a universal macOS binary, built from the same locked sources.
  • Linux x86_64: all 41 tests pass natively, and a scan of the 60-site comparison list matched the Windows build on 58. The other 2 differ only in pq vs pq-preferred, and re-checks showed both builds give the same answer per address: those servers answer differently from different CDN edges. TLS, the certificate check, SSH and SMTP STARTTLS all ran live.
  • Linux arm64: run under QEMU emulation against github.com, cloudflare.com and gitlab.com SSH, with the certificate check. Not yet on real Arm hardware.
  • macOS: built for macOS 11+, both slices link only libSystem, the arm64 slice is ad-hoc signed. Not yet run on a Mac.
• v0.2.1 released (2026-10-16): Flarebox for Windows and Linux (.deb), with signed self-updates; pqdoctor 0.2.1 (same behaviour as 0.2.0) with Homebrew, Scoop, winget and cargo-binstall.
• v0.2.0 released (2026-10-16): Flarebox’s per-user setup and MSI, and pqdoctor 0.2.0 for Windows, macOS and Linux and on crates.io. Not code-signed.

Against a real Cloudflare account

• Safety, DNS and SSL/TLS: checked against a real account. Their numbers matched the live sites.
• Zone-setting writes: 6 approved changes on two real zones (minimum TLS 1.2, Always Use HTTPS on, encryption Full (strict)), made after checking every proxied origin’s certificate would pass.
• Custom Origin Trust Store read: correctly says the Free zones need Advanced Certificate Manager.
• Flarebox’s own API client: Cloudflare’s trace endpoint reported kex=X25519MLKEM768.
• Workers, through wrangler: rollback, a gradual rollout and back, and a secret put and delete on a real Worker.
• Services a Worker calls: real reads for two real Workers. Cloudflare accepts the query and its fields; a real Worker’s hourly rows parse, merge across hours, and Cloudflare’s own destination (Turnstile) is labelled internal and not checked.
• Mail servers: one real MX check, on Cloudflare Email Routing’s route1.mx.cloudflare.net. The home network blocks port 25, and Flarebox reported exactly that instead of a verdict. A real MX verdict needs a network with port 25 open.

Against real servers and tools

• pqdoctor: 59 / 59 against OpenSSL 3.5 on real sites, 30 / 30 in the fix lab. See Accuracy.
• Origin checks: DNS record → origin → pqdoctor, against a real address.
• SSH check: github.com and gitlab.com, cross-checked with OpenSSH 10.0p2.
• STARTTLS: Gmail and Fastmail SMTP.
• ML-DSA certificates: OpenSSL 3.5.5 verifies Flarebox’s CA and certificate. A dual-certificate server gives pqdoctor “Serves”.
• Cloudflare Tunnel: a real Quick Tunnel carried a request from the internet to a local server.
• Local Workers: D1, KV and R2 editing, migrations, Durable Objects and Workflows, through real wrangler.
• Crypto scan: 6 correct findings in node-forge’s source, and none in 201 @noble files.

Updates and Linux

• Updater: the release installers’ signatures verify with minisign against Flarebox’s public key, and a tampered copy is refused. In the end-to-end test, an installer with a foreign signature is refused before it runs, and only the reviewed version installs. Not yet: a real update from one release to the next (0.2.1 is the first version with the updater).
• Linux: the .deb and AppImage were built and run in WSL (Ubuntu 24.04, WSLg): the window opens and renders. Not yet: a run on a physical Linux desktop.

Against a fake API only

Every other Cloudflare view is tested against Cloudflare’s documented API shapes through a fake API, in Rust tests and the native end-to-end test (496 checks). They haven’t run against a real account yet. That includes:

• Analytics, security events, the timeline and Workers observability (they need more read permissions)
• Cache purges, Rules, the WAF, Load Balancing, Snippets, Logpush and Access
• Live KV, D1 and R2 on the account
• DNS batch and import, HSTS and DNSSEC changes
• A trust store upload (it needs ACM, a paid add-on)
• Authenticated Origin Pulls uploads, switches and Verify (Verify also ran against a real OpenSSL 3.5 origin on loopback)
• The readiness report, which hasn’t been generated for a real zone yet

Not yet anywhere

• pqdoctor-web on Cloudflare’s network. It runs in wrangler dev. See On Workers.
• The GitHub Action on GitHub. Run locally only.
• A real origin fixed end to end: Flarebox’s history, fix report and “fixed” note have run on a lab server, not yet on a real origin behind Cloudflare.
• Flarebox on macOS and Linux. Type-checked for both, not run there.
• The pqdoctor CLI on a real Mac or real Arm hardware. macOS is built and inspected; arm64 ran under emulation.
• Public IPv6. Proven on ::1 only.

Tests

For 0.2.1: 307 app Rust tests (including the contract tests), 87 pqdoctor tests, 3 for the WebAssembly build, 103 UI tests, 4 for the GitHub Action, 14 for pqdoctor-web (including parity with the release CLI), and the native end-to-end test’s 503 checks. On Linux (WSL), the app’s unit tests pass too.