Security

The fleet

The probe fleet

Checks run from separate providers on separate autonomous systems, so that two of our machines cannot share one network's bad day. Every address is published at /ips.json, as a file you can paste into a firewall rule.

Marked points are the machines that run checks. The arcs are checks leaving them for targets elsewhere, not places we check from.

Your account

There is no password to steal or reuse: sign-in is a one-time code sent to your email, and the session lives in a cookie scripts cannot read. Codes are single-use, expire, and requesting a new one invalidates the old.

Everything is scoped to your account in the database query itself rather than checked afterwards.

Checkers cannot reach anything private

Public probes refuse private, loopback, link-local, carrier-grade NAT and cloud-metadata addresses, including the IPv6 spellings of the same addresses.

A hostname is resolved once and the connection is made to exactly the address that was checked, so a name that answers differently a moment later cannot slip past.

Each checker drops private-range traffic at its own firewall and holds no database credentials. A compromised checker can lie about the monitors assigned to it. It cannot read anybody's data.

How the probe machines are built

Each is administered only through an encrypted tunnel: SSH bound to the tunnel address, password authentication off, firewall accepting that connection from exactly one address. The provider's own firewall is an extra layer we do not rely on. The test we hold ourselves to is that a machine stays safe with the provider firewall deleted.

The state is asserted by a script that runs on each machine and checks what is actually running, not what a configuration file says.

Reporting a problem

Write to [email protected]. If traffic from one of our probes is unwanted, the abuse page explains what our checks look like and how to have a target excluded.