Security matters to us because people trust SiteDownCheck with monitor settings and email addresses. This page describes our responsible disclosure program and the protections we use. Our machine-readable contact details are at https://sitedowncheck.com/.well-known/security.txt.
Responsible disclosure
If you believe you have found a vulnerability in the service, please tell us privately before sharing it publicly, and give us a reasonable chance to fix it. We are an individual operator, so we ask for patience, but we will take every good-faith report seriously.
Scope
In scope:
- the website at https://sitedowncheck.com and its pages;
- the SiteDownCheck API and other endpoints served from https://sitedowncheck.com;
- monitor dashboards, status pages and email flows (confirmations, alerts, unsubscribe links) that belong to the service.
Examples of issues we want to hear about: server-side request forgery (SSRF) or bypasses of our address and port restrictions, injection, cross-site scripting, authentication or link-guessing weaknesses, access to another user's monitor data, exposed secrets, and weaknesses in the Content-Security-Policy.
Out of scope
- Websites that you test with our tools. They belong to their owners; report issues with them to those owners.
- Social engineering, phishing or physical attacks against the operator or users.
- Denial of service, load testing or any activity that degrades the service.
- Findings that only show rate limiting is present or can be reached, without further impact.
- Missing best-practice headers or settings with no demonstrated security impact, and reports from automated scanners without a proof of concept.
- Vulnerabilities in third-party services that we use (report those to the vendor).
Safe harbour
If you act in good faith, follow this policy and avoid harm, we will not pursue legal action against you or ask for you to be prosecuted for your research. Good faith means that you:
- only test against your own monitors or data, and do not access, change or keep other users' data beyond what is needed to show the issue;
- stop and report if you reach personal data;
- do not disrupt the service, run automated high-volume attacks, or use social engineering;
- give us reasonable time to fix the issue before you disclose it.
This is a statement of our intent as an individual operator and it cannot bind third parties such as hosting providers or authorities. If in doubt, ask us before you test.
How to report
Email contact@sitedowncheck.com with the subject "Security". Please include:
- a clear description of the issue and its likely impact;
- the affected URL, endpoint or feature;
- step-by-step instructions or a proof of concept that lets us reproduce it;
- any logs, screenshots or requests that help (please redact other people's data);
- your name or handle if you would like to be credited, and how to reach you.
Please do not include real personal data of other people in your report.
What to expect
| Step | Target |
|---|---|
| Acknowledge your report | Within 3 working days |
| Initial assessment and severity | Typically within 10 working days |
| Fix or mitigation for confirmed issues | Depends on severity; we aim for prompt fixes for serious issues |
| Update you on progress | When there is a meaningful change, or at your request |
We do not offer a monetary bounty. With your permission, we are happy to thank you publicly for a valid report. We ask that you keep details private until we have confirmed a fix, or until 90 days have passed without a response from us, whichever is sooner.
How we protect the service
We use a set of layered protections. No system is perfectly secure, but these are in place by design:
- SSRF protections: our servers block private, loopback, link-local and internal addresses and non-web ports when making checks, so that the service cannot be used to reach internal systems.
- Rate limiting: requests are limited per IP address to reduce abuse and overload.
- Strict Content-Security-Policy: pages are served with a strict policy and no inline scripts, which limits the impact of cross-site scripting.
- HTTPS and HSTS: the site is served over HTTPS with HTTP Strict Transport Security.
- Input validation: domains, URLs and other inputs are validated before they are used.
- Private monitor links: dashboards are reached through private, unguessable links rather than passwords, and email confirmation may be required before a monitor starts.
- Data minimisation: free checks are not tied to a profile, developer tools run in your browser, and old monitor history is pruned after about 100 days.
See our Privacy Policy for how data is handled, and the Acceptable Use Policy for what is not allowed.
Incidents
If we find a security incident that affects user data, we will contain it, investigate it, fix the cause, and notify affected users and relevant authorities where the law requires.
Contact
Send security reports to contact@sitedowncheck.com with the subject "Security".