Cure53 audited Obscura’s macOS app, network extension, and protocol in December 2025. Obscura says the audit found no major vulnerabilities within the defined threat model, and that the lower-severity issues were fixed. The audit writeup also describes memory-safe, statically typed implementation choices across TypeScript, Rust, and Swift.
The main caveats are jurisdiction, age, and correlation risk. Obscura is operated by Sovereign Engineering Inc. and its terms use New York law and venue. The two-party design is the mitigation: Obscura should not see decrypted traffic, and Mullvad should not see identity. It is still a young service. Compared with direct Mullvad, it reduces single-provider trust for modest extra cost and likely performance overhead. Compared with Tor, it is built for faster everyday VPN use, but Tor distributes trust across a larger circuit.
Use Obscura VPN when you want a VPN-like workflow but do not want one provider to see both your identity and traffic. Use Mullvad direct when simplicity, maturity, and cost matter more than the two-party trust split.
Sources: Obscura, Obscura pricing, Obscura audit post, Obscura legal, and Mullvad’s partnership post.
]]>