Security and rate limiting
Protection against abuse
Registration, sign-in, password reset, status page unlock and email subscription are rate limited per email address or page, and per client Internet Protocol (IP) address. After too many attempts the action is blocked for 10 minutes, then 1 hour, then 1 day. Only failed attempts count for sign-in and unlock. Counters reset after 24 hours without attempts.
Registration and email subscription also require a proof-of-work captcha that runs in your browser.
Registration, password reset, invitations and unsubscribe respond identically whether or not an address exists.
How data is protected
| Data | Protection |
|---|---|
| Account passwords and status page passwords | Stored as BCrypt hashes. |
| Application Programming Interface (API) keys | Stored as SHA-256 hashes and shown once. |
| Secret link tokens | 256 bits of randomness. |
| Status messages | Markdown is reduced to headings, emphasis, lists, quotes and code. Links, images and HTML are removed. |
| Monitors | Requests to loopback, private and internal addresses are blocked, including after Domain Name System (DNS) changes. |
In the browser
Forms use Cross-Site Request Forgery (CSRF) tokens. Pages are served with a Content-Security-Policy header, a Strict-Transport-Security header and a strict referrer policy.
Isolation between services
Every back-office page checks that you are a member of the service and that your role allows the action. Another service's pages answer with 403 or 404.