Redlib is an open-source, self-hostable private front-end to Reddit, written in Rust and originating as a fork of Libreddit; it is maintained on GitHub by a small pseudonymous team under the "redlib-org" organization, which discloses no legal entity, company, or contact address. Its README describes the software as having no JavaScript, no ads, and no tracking, proxying all requests (including media) through the server so the browser never contacts Reddit, storing user settings only in optional cookies that hold no personal data, and logging nothing in production; it also states that Redlib spoofs Reddit's official Android-app OAuth tokens and headers to avoid rate limits, a design that Reddit-side changes have repeatedly disrupted. Because it is instance-based, whichever public instance a user picks can see that user's IP address and every page requested, and the project's own instance list is self-submitted and flags at least one instance as sitting behind Cloudflare. The project published one high-severity GitHub Security Advisory (CVE-2025-30160, a denial-of-service bug, patched in v0.36.0); no breach, regulatory action, or third-party audit was found in this research.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
11 ON FILE
COLLECTION
Redlib's README describes the software as having no JavaScript, no ads and no tracking, implementing only Reddit's signed-out functionality (no Reddit account or login is possible through it), and states that the only client-side state it keeps is optional cookies for user-configured settings, which are not cross-site cookies and hold no personal data.
Privacy Guides lists Redlib as its recommended Reddit frontend under published criteria requiring recommended frontends to be open-source, self-hostable, and to provide all basic website functionality to anonymous users without an account; the same page cautions readers to check the privacy policy of whichever public instance they use.
Redlib's complete source code is published under the GNU Affero General Public License version 3 (AGPLv3), whose network clause means anyone running a modified instance for others must offer them the modified source — allowing the actual running code to be inspected, audited or forked.
The README documents the project's lineage — a fork of Libreddit renamed to avoid legal issues with Reddit's naming rules — and lists its public presence on Matrix, Quay.io (container images), GitHub and a GitLab mirror; it identifies no company, foundation or named individual as the responsible party.
Redlib is developed under the "redlib-org" GitHub organization, created 2023-12-24, whose public profile discloses no organization name, company, website, location or email address; the project's top contributors are pseudonymous GitHub accounts and no legal entity or funding source was found.
The README's Privacy section states that in production Redlib logs nothing (only post IDs are logged in debug builds), while separately warning that free hosts such as Replit and Heroku are not private and monitor server usage; the statement covers the software, not the operator of any given public instance, who terminates the connection and can see the user's IP address and every page requested.
The project's official instance list (redlib-instances, updated 2026-08-15) enumerated seven public instances hosted in the US, Germany, India and Finland plus one Tor onion; entries are self-submitted by operators, validated only by version check, and the schema flags whether an instance sits behind Cloudflare — at least one listed instance did, placing a second third party in the request path.
The README states that Redlib circumvents Reddit's rate limits by spoofing the OAuth tokens and HTTP headers of the official Android app, refreshing the token every 24 hours to emulate it — an explicitly adversarial dependency on an unofficial access path that Reddit can, and periodically does, disrupt.
On March 20, 2025 a Redlib maintainer published GitHub Security Advisory GHSA-g8vq-v3mg-7mrg (CVE-2025-30160, rated high): a base2048-encoded DEFLATE decompression bomb submitted to the settings-restore form could exhaust memory and take down any public instance; the advisory names the introducing and fixing commits and directs users to upgrade to v0.36.0 — the only security artifact found, and one for a denial-of-service bug rather than a data exposure.
A maintainer-opened tracking issue (June 25, 2025, still open with 300+ comments at fetch time) documents Reddit-side rate-limit changes that began breaking public Redlib instances, asking instance operators to test restarts while the maintainer investigated — illustrating the reliability fragility of the spoofed-client design rather than any privacy incident.
The README states that all requests, including media, are proxied through the Redlib server and that a strong Content Security Policy prevents the user's browser from making any request to Reddit — so Reddit's cookies, advertising partners and analytics never load client-side; no analytics or advertising component is disclosed anywhere in the README's configuration tables.