It feels private because you sent the link to one person. It is not private at all. A public tunnel URL can be opened by anyone who has it, finds it, forwards it or probes for it — and automated systems spend all day looking for exactly these links.
Most tunnel accidents grow from one wrong feeling: 'only my client has the link.' Links get forwarded to colleagues, pasted into group chats, captured in screenshots, logged by the services they pass through, and tried by bots that probe tunnel address ranges around the clock. This page replaces the feeling with the fact — and shows the working style that stays safe inside the fact.
Your control over the link ends the moment you press send. Plan every session for an audience of everyone.
A long random address looks like a lock. It behaves like a rumour. It travels through forwards, chat previews that fetch it automatically, browser histories, screenshots and logs — every hop outside your control. Security professionals have a name for depending on it: security through obscurity, and it is classified as no security at all. The controls that actually work are the boring ones: authentication in front of anything sensitive, sample data only, and a session so short that exposure barely has time to happen.
Attackers know businesses demo internal tools through tunnels, so tunnel address ranges are scanned continuously by software, not by curious humans. The probes test new addresses for login pages, dashboards, cameras and admin panels — the valuable doors. This is why admin tools must never sit behind a tunnel even once: the probe does not need your link, your permission or your knowledge. It finds the address by itself, politely, thousands of times a day, and it knocks on every single one.
If a demo must be limited to a smaller audience, use the access controls available to you — a login on the application itself, or an access rule offered by the tunnel service. Be honest about what this buys: a password stops casual opens and the great mass of bots cold, which is genuinely valuable. It does not make a weak or unpatched application safe against someone determined. A password is a gate on a public road, not a move to a private island.
While the session runs, the server and tunnel terminals show every request as it arrives — which pages, in what order, how fast. Normal browsing has a human rhythm: a page, its images, a pause, the next page. Probing has a machine rhythm: dozens of requests a second for paths you never built, admin pages, famous filenames. Learn to recognise the second pattern at a glance. The moment you see it, end the session early, close the tunnel, and review the checklist before the next one.
Every other protection on this page is a backup for this one. Open the tunnel when the meeting starts; close it when the meeting ends. An address that exists for forty minutes has a tiny fraction of the exposure of one left running all week, and the fresh-address behaviour of free tiers then works for you instead of against you — every session begins with an address nobody has seen. Exposure is mostly a function of time. Spend as little of it public as the job allows.
Watch the video to see how easily a public link comes alive — this page is the mindset to have running in parallel while it does.
Watch Full VideoPossibly, yes — and plan as if they did. Tunnel address ranges are watched continuously and ten minutes is a long time for automated systems. This is not a reason to panic. It is the reason demos carry sample data, admin tools stay off tunnels, and the session gets switched off promptly instead of eventually.
Your server and tunnel tool show requests as they arrive — the paths requested, the times, and usually the visitor's network address. That tells you that someone visited and what they asked for; it does not tell you who they are. Visits asking for admin paths or famous vulnerable files are probes, and seeing them is your signal to end the session.
No. It is a public website with a lock on the door. The software behind it is still internet-facing, with its own bugs, and the address is still public knowledge. For systems that are genuinely private and used every day, the right tools are a VPN or a proper access service — not a demo tunnel left running and hoped about.