Security

API Watch is deployed as a single VPS application. In production, the intended setup terminates HTTPS at Caddy and keeps the application port private to the Compose network.

Account and data controls

• Passwords are stored as scrypt hashes and never returned by account APIs.
• Monitor APIs require an account session and scope queries to that account.
• Discord webhook, Telegram chat ID and alert-email fields use AES-256-GCM when DATA_ENCRYPTION_KEY is configured. Production startup requires this key.
• Monitor probes reject non-public IP ranges and validate redirect destinations.
• Public status pages include only monitors that the account explicitly publishes.

Operational boundaries

The service currently runs on one VPS with SQLite and one monitoring worker. It is not a multi-region network, has no SOC 2 or other compliance certification, and does not promise an uptime SLA.

When configured, email delivery uses Resend, billing uses Stripe, and user-selected alerts can use Discord or Telegram. These providers receive the information needed to perform their requested service.

Report an issue

Security contact: test@overover.site. Provide a reproducible description without sending live secrets or credentials.