The finding is solid. The screenshot in the appendix shows your home ISP in the IP widget and a clock that does not match the region you claimed to test. The client did not ask for a portrait of your apartment network. They got one anyway.
The problem
On the finding's screenshot — the tester's home ISP in the IP widget and a clock that doesn't match the ticket's region. The client didn't ask for a portrait of the tester's home network. They got one anyway.
What we did
Listed what leaks without a single payload (fetch diagnostics, HAR files, proxy logs, Intl, extensions in the everyday profile) and assembled a small, boring kit: address — a VPN with a kill switch, clock — Timezone Spoofer, profile — a separate one per project.
What came out
A checklist before the first request and after the last. The finding describes the system, not the tester's flat; the HAR is named after the ticket, not dump(1).har.
OPSEC here is not "become invisible". It is hygiene for authorized work: the tester's household should not become an artefact.
What leaks without a payload
You do not need a clever trick. A page that prints fetch diagnostics, a status panel, a CDN error, a payment sandbox — they all echo the client address. HAR files and proxy logs do the same. So do "contact us" forms you opened to test rate limits.
The clock leaks next to the address. We wrote that out in timezone leaks in security tests: Intl does not care about your DevTools locale.
Browser extensions you use for shopping sit in the same profile as the test. That is a second fixture problem: the site under test sees your daily browser, not the clean account in the statement of work.
A small, boring kit
We keep the kit small on purpose.
Address. Noname VPN issues a key in Telegram — @unlocknoname_bot — no email, a free day at full speed, then pay per day in the same chat when you still need the route. One key in the iOS and Android apps. A kill switch is the minimum; if the tunnel dies, the test stops, it does not silently fall back to home.
Clock. Timezone Spoofer overrides page-context time so the tab matches the exit (or a pinned IANA zone). Auto-detect from IP is the default for this job.
Profile. A dedicated browser profile for the engagement. No shopping extensions. Cookies from last year's travel stay out of this HAR.
None of that replaces a written scope. It stops the report from documenting the tester.
What this is not
It is not a method for hiding from anyone. It is not a list of scanner flags. It is not permission to touch a host that is not in the contract.
If you still need the vocabulary — assessment vs pentest vs scan — start with the opening piece. If the work is a web review inside the editor, that is Forge IDE.
One checklist we reuse
Before the first request of the day: tunnel up, kill switch on, spoofed (or auto) zone, clean profile, scope file open. After the last request: tunnel down, profile closed, HAR named with the ticket id — not dump(1).har on the desktop. The finding should describe the system, not the tester's weekend Wi-Fi.
OPSEC in sanctioned work is the quality of the report you receive: nothing extraneous in it, including us. Noname VPN and Timezone Spoofer grew out of this checklist — we do our own work with them, then hand them to you.What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.
Products in this article
A report without extra witnesses
A pentest or security assessment with a written scope — tell us what we test and what “done” means.
Timezone leaks in security testsA test account in 'Frankfurt' that still greets you with the home clock is a broken scenario — and a fingerprint. How authorized testers keep IP and timezone in the same story.
Timezone Spoofer: fix the clock that betrays your VPNA VPN changes your IP but not your browser clock. Timezone Spoofer — our free extension for Chrome and Safari — fixes the mismatch in one click.
VPN Chrome extension: what it protects and what it doesn'tA Chrome VPN extension is a proxy for browser traffic only. What it really protects, where it leaks, and when you need a full VPN app instead.