Hosting
Agent Pong runs on a serverless platform, and its data is stored in a managed SQL database. Status pages are cached for a few seconds; the cache is cleared whenever an incident, maintenance window, component or page setting changes.
Accounts and sessions
- Passwords are hashed with PBKDF2-SHA256, 100,000 iterations and a random 16-byte salt per password. The password itself is never stored.
- Sign-in and sign-up are rate limited.
- The session cookie,
sid, is HttpOnly, Secure and SameSite=Lax. Sessions end when you sign out or after 30 days. Changing your password signs out your other sessions. - Every request that changes something in the dashboard must come from Agent Pong’s own origin. Requests sent from other sites are refused, so they can’t submit forms on your behalf.
API keys
- A key is shown once, when you create it. Agent Pong stores only its SHA-256 hash.
- Keys belong to a team and can only act on that team’s pages, incidents and health checks.
- A revoked key stops working immediately. Keys are also revoked when the account that created them is deleted.
Team data
Status pages, components, incidents, maintenance windows, templates and health checks belong to a team. Every dashboard and API request is limited to the signed-in member’s or the key’s own team. Individual check results are kept for seven days; hourly summaries are kept while the health check exists.
Health checks
- Check URLs are tested against private, loopback and internal addresses when you save them, and again before every request, including every redirect hop (at most five).
- URLs with embedded credentials are refused.
- Requests identify themselves with the user agent
Agent Pong/0.1 (+https://agentpong.com/bot). What the checker does.
What status pages publish
A status page shows the components, incidents and maintenance windows you put on it, with their status and history. The “How we monitor” section, which lists the health checks behind each component, is off by default. When a page turns it on, request headers, bodies, query strings, asserted values and token-like path segments still stay private.
Cookies and tracking
The only cookie is the sid session cookie, set when you sign in. The marketing site and status pages set no cookies, and there are no analytics or advertising cookies. Our pages load their typefaces from Google Fonts.
Security reviews
Enterprise customers get help with security reviews and questionnaires. Single sign-on is on the roadmap and not available yet. To ask a question or report a vulnerability, contact us.