Security
Reporting a vulnerability.
Email support@eonix.lk with the subject “Security: UptimeScout”.
Include the app version and build (Settings › About), the platform and OS version, reproduction steps and the impact you observed. Please do not include real API keys or other people’s data.
- We acknowledge reports within 2 business days and share an assessment and planned fix timeline within 10 business days.
- Please give us 90 days, or until a fix is released, before public disclosure. We credit reporters who want to be named in the release notes.
- Good-faith research that avoids privacy violations, data destruction and service disruption, and that targets only your own devices and accounts, will not be pursued legally.
- Supported versions: the latest release on the App Store.
Security model
What the app does to deserve your keys.
Monitoring means handing a tool the addresses of everything you run, and often a credential to the service that watches them. These are the decisions that follow from that.
Keychain, device-only keys
Source API keys are Keychain items with “after first unlock, this device only” protection, and are not synchronizable. They are never written to the database, exports, logs or iCloud. Revealing one in the app requires Face ID, Touch ID or your passcode. Requests to UptimeRobot, Better Stack and Cronitor always go to that provider's fixed API host, whatever a stored or imported record says, and a request carrying a key follows a redirect only to the same host — any other redirect is refused rather than re-sending the key.
No custom trust
TLS uses the operating system's default certificate evaluation. The SSL check observes the presented chain to report expiry and trust, but always defers to default handling: no certificate pinning bypass, no acceptance of invalid certificates, no custom trust store.
Transport security
Plain HTTP is accepted solely for local-network hosts, and the app validates that before saving a monitor or source. Everything else is HTTPS. Better Stack pagination links are followed only to the API's own origin.
Sandbox
The macOS app runs in the App Sandbox with outgoing network connections and user-selected files only, under the hardened runtime. No helper tools, plug-ins, downloaded code, script interpreters or web views.
Redacted diagnostics
Logs use Apple's unified logging with private-by-default interpolation. The optional diagnostics export is generated on your device and redacts authorization headers, named secrets, URL query strings, credentials in URLs, email addresses and long opaque tokens before you save it.
No telemetry
No analytics, no crash-reporting SDK, no developer server. Data leaves your device only to the hosts you check, the services you connect, and Apple.
Input hardening
Imports are read through a size-capped handle and validated. Names and messages arriving from a source or an import file have control and bidirectional-override characters removed, so an alert cannot be made to read differently than it is. CSV exports neutralise spreadsheet formulas, network responses are size-capped per chunk, and the certificate and metrics parsers are bounds-checked and covered by malformed-input and fuzz tests.
Check integrity
DNS checks require A and AAAA answers to equal the expected address exactly, so a record hijacked to 110.0.0.10 never passes for 10.0.0.1. Only StoreKit-verified transactions grant Pro.
Checked on every change
Every change is scanned for secrets twice — once across the files being committed and once across the history — with static-analysis rules enforcing the Keychain, networking and logging decisions above. Test builds fail on compiler warnings. CI runs all of it, with the tools pinned and verified before they run.
This website
The site has no accounts and no forms.
There is nothing here to sign in to, nothing to submit and nothing stored about you. That is deliberate: the fewer moving parts on the domain your app points at, the fewer ways someone can impersonate it.
- Static pages only — no server-side code, no database, no user input reflected into a page.
- A Content Security Policy that permits no other origin to load anything and gives an injected script nowhere to send data, with forms and framing forbidden outright.
- HSTS,
nosniff, a strict referrer policy and a minimised permissions policy, asserted by the test suite on every build rather than merely configured once. - No cookies, no storage, no analytics and no third-party scripts — see the privacy policy.
Neither this site nor its support email will ever ask you for an API key — see how keys are handled.