About devgate

The domain was registered on 1 July 2026, so any reputation service you check will call devgate a very young site — and it is right. Tunnelling domains also collect suspicion by nature: they exist so that other people's content can be served through them. Neither fact makes a service unsafe, and neither should be taken on faith. What you can check instead: the agent is a single static binary whose downloads are published with a SHA256 manifest, it connects outbound only, and every device registers its own key rather than sharing one secret.

If you are weighing devgate for something sensitive, the reasonable answer today is: try it for what a tunnel is for — sharing work in progress, receiving webhooks, demoing to a client — and keep production credentials out of it until the project has a longer track record. We would rather say that than pretend the track record already exists.

devgate publishes HTTP and HTTPS endpoints, and does that part well. Outside that scope today: TCP, TLS and UDP tunnelling, an edge policy engine, a Kubernetes operator, and formal certifications such as SOC 2 or a HIPAA BAA. Knowing where a tool stops is worth as much as knowing what it does, so the boundary is written down rather than left to be discovered.

Where a competitor covers what devgate does not, we say so on the comparison page.

The name is not unique. This project is devgate.online and nothing else: not devgate.io, not the devgate npm package (a local HTTPS proxy using sslip.io), and not any older company of the same name. The agent is distributed from this domain and through the Homebrew tap — nowhere else.

A human reads dmitry@devgate.online — bugs, questions, abuse reports and security disclosures alike. More on that on the contact page.