The Tor Project's privacy policy describes no sharing of Tor Browser user data with any third party; the browser's design routes traffic through the volunteer-operated Tor network rather than through any commercial partner, and the drafted record contains no advertising, analytics, or vendor data relationship.

In a public statement dated 2016-03-21 issued during the Apple-FBI encryption dispute, The Tor Project stated that it had never received a legal demand to place a backdoor in its programs or source code, nor any request to hand over cryptographic signing material, and that it will never backdoor its software. The statement sets out the engineering controls the project relies on to make covert compliance detectable -- fully open source code, reproducible builds producing bit-for-bit identical binaries, anonymous update requests over the Tor network, pinned HTTPS certificates and package-level cryptographic signatures -- and notes that several developers have stated they would resign rather than honour such a request.

The Tor Project announced its first public bug bounty on 2017-07-20, run on HackerOne with support from the Open Technology Fund, with published scope covering Tor (the network daemon) and Tor Browser, named target classes including local privilege escalation, unauthorised access of user data, leakage of relay or client cryptographic material, and remote code execution, and awards of up to USD 4,000 per bug report depending on impact and severity. The post also records that a preceding private bug bounty launched in January 2016 surfaced three crash or denial-of-service bugs and four edge-case memory corruption bugs.

As reported by The Record on 2021-12-03, a threat actor tracked as KAX17 had run malicious Tor relays since at least 2017, at one point giving traffic up to a 5% chance of exiting the network through one of its servers, and The Tor Project removed several hundred relays very likely belonging to the group in October and November 2021.

In a 2022-04-25 post on the health of the Tor network, The Tor Project acknowledged that the low threshold for contributing relays also makes it easier for malicious operators to attack users, and described its remediation process: problematic relays are first addressed with the operator, then proposed for rejection, with removal decided not by Tor staff but by the network's directory authorities acting by majority consensus.

The Tor Project published the findings of a Cure53 security audit of Tor Browser and related censorship-circumvention components on 2023-10-25. The testing period covered 72 days between November 2022 and April 2023 and was followed by a period of issue mitigation. The post reports nineteen issues including two high-severity findings in rdsys and BridgeDB, states that both were subsequently mitigated, and commits the project to continuing to conduct regular security assessments and share them publicly.

In a post dated 2024-04-10, The Tor Project states that it contracted Cure53 in January 2024 to audit all code changed or created during a multi-year censorship-circumvention project whose outputs include the Webtunnel pluggable transport, the Lox bridge distribution system being integrated into Tor Browser, the RDSys distribution system, and the Connection Assist feature in Tor Browser, and reports that all vulnerabilities uncovered by that audit have been mitigated.

The Tor Project published a further Cure53 assessment on 2026-04-15, covering a penetration test and source code audit conducted in June 2025 of TorVPN for Android and the Onionmasq tunnel layer. The post summarises the findings -- incomplete input validation, DNS handling weaknesses, and cryptographic and mobile hardening suggestions -- states that Tor's core integration was found robust with no fundamental issues in tunnel establishment or routing, and links the full report. Taken with the 2023 and 2024 audits, this establishes a repeated published third-party audit cadence for the publisher of Tor Browser.