The panel source stays private
Nova Proxy asks you to deploy an obfuscated worker.js into your own Cloudflare account. The README describes user quotas, expiry dates, private subscription links, and VLESS plus Trojan configurations. That could spare an individual the work of maintaining a proxy server. The awkward part comes before you connect: you can inspect the deployed artifact, but the maintainable panel source is private. Anyone choosing this for inspectable infrastructure should stop at that distinction.
The README says releases through 4.2.0 retain their historical MIT grant. Nova-authored changes starting with 4.3.0 use PolyForm Noncommercial, which excludes reselling access or paid hosting without permission. This is a material adoption constraint, even though self-hosting for noncommercial use remains allowed. A personal proxy and a commercial proxy service face different decisions here. Calling the current panel fully open source would misdescribe what its own documentation says.
What happened when we ran it
Our sandbox installed Nova Proxy at commit d25a40d in 14 seconds, adding 68 packages and occupying 232 MB. The run used a fresh Debian container with 3 CPUs, 8 GB of RAM, Node 22, no secrets, and no elevated privileges on October 14, 2026. Installation succeeded. Npm audit reported 0 known vulnerabilities, which describes the dependency check and says nothing about the privacy of traffic passing through the worker.
The build failed with exit 1 after 1 second. Its log says Node could not find /work/repo/scripts/build.mjs. The test command also failed with exit 1 after 1 second, and its supplied tail reports MODULE_NOT_FOUND without identifying the missing path. We cannot claim that both failures name the same file. Neither command produced evidence of a working deployment, and we did not measure connection speed or filtering resistance.
Our checkout contained 36 files, about 1,055 source lines, and occupied 1.5 MB before installation. The scan found 2 CI workflow files, no Dockerfile, and no tests directory. A workflow file cannot substitute for a successful local check. More usefully, pull request 168 explicitly discusses the absent build script in the public deployment flow. That report supports treating this as a practical adoption problem, rather than silently working around it in a review.
Cloudflare supplies the hosting, while calls need another path
The Nova Proxy README offers a Cloudflare deployment button and a Wrangler route. It says the supported flow provisions and binds KV and D1 automatically. You then open the worker's admin route and create the admin login. The account belongs to you, so you carry the platform limits and the responsibility for the panel. Subscription links act as credentials and deserve the same care as passwords.
Our 232 MB installed environment covers the local package footprint, not the extra services you may choose. The optional Telegram bot adds another administration route. GitHub mirroring publishes subscription material through a repository, and proxy chaining or backend mode brings another network hop under your control. Those features have different exposure and recovery implications. Start with the smallest configuration that solves your connection problem before adding alternate distribution or management paths.
The README explicitly says a plain free Worker cannot carry UDP for voice and video calls. It directs users to WARP or a backend server for that traffic. That condition matters more than the broad list of supported protocols: a working subscription import does not establish that a WhatsApp call works. Anyone buying into the project mainly for calling should evaluate that separate route on the actual network they intend to use.
Traffic quotas need an independent check
Nova Proxy advertises per-user quotas and daily limits, but issue 159 reports the panel counting only a small share of a user's traffic. That is a user report, not an outcome from our sandbox. Still, quota accounting is central to administering shared access. If you need enforceable allowances, compare panel totals against a source you trust before distributing links to a group.
A clean dependency audit with 0 known vulnerabilities does not settle that accounting question, nor does it prove the README's no-logging claim. Our failed local commands never reached a traffic exercise. For this kind of tool, distinguish the author's described privacy policy, the source you can examine, and behavior you have personally checked. The protected artifact makes that review harder for readers who ordinarily audit the source they deploy.
October activity has not removed the deployment uncertainty
The last push was October 9, 2026, and the latest published release endpoint returned v4.9.2 from September 15. GitHub listed 16 open issues and PRs. Recent discussion includes the public build problem, so the dated release alone would be a poor reason to call the project abandoned. The README's version badge and release-notes summary also disagree with that release endpoint, which makes careful version selection necessary.
For a server you already control, sing-box or Xray-core offers a different route with public source and more infrastructure responsibility. Nova's appeal is the Cloudflare panel and personal-account deployment. I would revisit it after the documented public deployment path works and traffic accounting is checked. Until then, the missing build script is a concrete obstacle between the attractive feature list and a proxy you can confidently hand to someone else.