Security
Last updated: June 2026
Security is foundational to MonitorKit — you're trusting us with your infrastructure metrics, logs, and APM traces. This page describes how we protect your data and how to report vulnerabilities responsibly.
Responsible Disclosure
If you discover a security vulnerability in MonitorKit, please report it privately. We commit to:
- Acknowledge your report within 48 hours
- Provide a remediation timeline within 7 days
- Notify you when the fix is deployed
- Credit you publicly (with your consent) in our security changelog
Report to:
[email protected]
Please include: steps to reproduce, impact assessment, and your contact details.
We ask that you not disclose publicly until we've had time to remediate.
Scope: Only test against accounts you own. Do not perform denial-of-service attacks, automated scanning against our production infrastructure, or access other users' data.
Authentication & Sessions
- Passwords are hashed with bcrypt (cost factor 12). Plaintext passwords are never stored or logged.
- Sessions use signed JWT tokens (HS256) stored in httpOnly, SameSite=Lax cookies — inaccessible to JavaScript.
- Two-factor authentication (TOTP) is available for all accounts via any TOTP-compatible app (Google Authenticator, Authy, etc.).
- Rate limiting — failed login attempts are tracked per IP. After 10 failed attempts in 5 minutes, the IP is temporarily blocked.
- Session invalidation — changing your password immediately invalidates all existing sessions.
Multi-Tenant Data Isolation
Every row in every table (hosts, metrics, logs, traces, alert rules) is scoped to an org_id. All queries enforce this filter — it is not possible for one organization to read another's data through the API.
- Agent API keys are per-organization and individually revocable.
- Sessions without a valid
org_idare rejected at the authentication layer. - Superadmin operations (platform-level) are logged with actor and timestamp.
Transport Security
- All traffic is served over HTTPS. HTTP is redirected to HTTPS at the Nginx level.
- The following security headers are set on every response:
X-Content-Type-Options: nosniffX-Frame-Options: DENYReferrer-Policy: strict-origin-when-cross-originPermissions-Policy: camera=(), microphone=(), geolocation=()
- SSRF protection is applied to any URL the server fetches (infrastructure health checks, webhooks).
Data Handling
- APM SQL scrubbing: Query parameters are replaced with
?before storage. Raw values are never sent to our servers. - Log retention: Log data is automatically deleted after your plan's retention period (7–365 days). You can delete a host and all its data at any time from the dashboard.
- Metrics retention: Raw snapshots are retained for 30 days. Older data is purged by an hourly background job.
- Secrets: API keys are stored as SHA-256 hashes. The plaintext key is shown only once at creation time.
Payment Security
Payment processing is handled entirely by Paddle (our Merchant of Record). MonitorKit never receives, stores, or processes credit card numbers. Paddle is PCI DSS Level 1 certified.
Incoming webhook events from Paddle are verified using HMAC-SHA256 signatures before any action is taken.
Infrastructure
- Hosted on Vultr (The Constant Company, LLC) — data center in Chicago, United States.
- Database backups run daily and are stored encrypted.
- The server runs as a non-root user inside Docker with a read-only filesystem where possible.
- Dependencies are pinned and reviewed with each release.
Security Changelog
We publish a summary of security fixes with each release. Major fixes are noted below:
June 2026 — Fixed 12 issues identified in an internal security audit: XSS via unescaped user-controlled strings in dashboard, rate limiter now only counts failed logins, Paddle webhook org resolution hardened (removed attacker-controlled fallback), metrics endpoint DoS cap added, APM plugin enforcement gap closed, cross-tenant session guard added at authentication layer.
Contact
For security issues: [email protected]
For general inquiries: [email protected]