Security and operations

• Outbound security boundary

  A single safe network client parses URLs, restricts schemes and ports, resolves once, validates every IPv4 and IPv6 answer including mapped and embedded forms, pins the connection, re-validates every redirect, strips sensitive headers on origin change, verifies TLS by default and enforces time, size, redirect and decompression limits. Tools, monitors, crawlers and webhooks all use it.

• Probe isolation

  Probes have no database or cache access. They lease work over HTTPS with revocable tokens, and results are accepted only with a matching per-run lease token from the leasing probe. Stale configuration versions and replays are rejected.

• Tenancy

  Billing account and workspace ids from requests are never trusted; every service call resolves the caller's memberships and permissions first. Client viewers are confined to their assigned workspaces. Caches hold public projections only.

• Credentials

  Monitor and channel secrets are encrypted at rest with AES-256-GCM under versioned keys and bound to their owning record. API keys, probe tokens, heartbeat tokens and invitations are stored as hashes. Secrets are redacted from logs, audit entries, exports and read endpoints.

• Authentication

  Verified email, strong password hashing by a maintained library, TOTP two-factor with recovery codes, session listing and revocation, rate-limited sign-in, short-lived reset and invitation tokens, secure cookies.

• Billing integrity

  Webhook signatures are verified against the raw body; events are persisted and deduplicated; out-of-order events are ignored; plans are never activated from a return URL.

• Operations

  Environment validation refuses test-only settings in production, structured logs redact secrets, health and readiness endpoints exist for every process, retention and rollups are idempotent, and the worker exposes queue depth and scheduler lag.

• What is not claimed

  No SOC 2, ISO 27001 or other certification. No independent status page infrastructure until deployed. No guaranteed uptime or response times.

Report a security issue through the contact page. We acknowledge reports and keep reporters informed, but do not run a paid bounty program.