Subscription endpoints, node lists, and client configurations require ongoing updates to remain functional against evolving blocking, but accepting automatic configuration updates introduces supply-chain risk. Open-source code makes inspection possible but does not prove the binary matches the source, that an audit was performed, or that the server follows its stated policy.

Clash-family proxy clients carry specific leak vectors distinct from VPNs: DNS leaks, IPv6 leaks, TUN-mode misconfiguration, rule-set bypass, and application-layer exclusions. Subscription URLs are equivalent to credentials and must be kept private; rotating a URL without evidence of a leak does not mitigate operator-level risk.

§4.2, §5.3, §5.5 defense

Traditional VPN and proxy protocols can both be detected, blocked, rate-limited, or disrupted by mainland network controls. Newer transport or obfuscation layers do not guarantee resistance; no client category is inherently undetectable, faster, lighter, or safer.

§4.4 detection

Provider identity mismatches are a documented risk: one reviewed provider (SSONE) displays the domain hello-ssone.com but its registration links to flybit6202.com. Resolving such domain-identity mismatches before entering credentials or paying is flagged as a required evaluation step.

§5.2 deployment

An encrypted proxy (Shadowsocks, Trojan, VMess) protects only the client-to-server segment; traffic from the proxy server to a non-HTTPS destination may be readable on the onward path. Applications not covered by system-proxy, TUN, or routing rules connect directly, bypassing the tunnel entirely.

§1.1 defense