Security
Security at ServerScope
How to report a problem responsibly, which safeguards the application has, and what you can do yourself. We only list measures we can point to in the product.
Reporting a vulnerability
Found something that could put users or their data at risk? Tell us privately, so it can be fixed before it is shared.
- 1 Use the contact form and choose a subject like “Security report”.
- 2 Describe what you found, where, and the steps to reproduce it.
- 3 Never include passwords, API tokens, webhook secrets or other people’s data.
- 4 Give us reasonable time to fix the problem before disclosing it.
Keeping your account safe
- Enable two-factor authentication and keep the recovery codes somewhere safe.
- Give each integration its own API token with only the abilities it needs, and an expiry date.
- Revoke tokens you no longer use, and rotate agent tokens and webhook secrets after a suspected leak.
- Never paste tokens, secrets or passwords into tickets, chats or the contact form.
Safeguards in the application
These are part of the ServerScope application and are described in the documentation.
-
Two-factor authentication
Time-based codes from an authenticator app, with one-time recovery codes.
-
Hashed API tokens
Tokens are shown once and stored only as a SHA-256 hash, limited to read or write and optionally expiring.
-
Signed webhooks
Every delivery carries an HMAC-SHA256 signature and a timestamp you can verify.
-
Encrypted Discord URLs
The webhook URL (which contains a token) is stored encrypted and masked everywhere it is shown.
-
Only public check targets
Website checks and webhooks refuse internal addresses, also after a redirect or DNS change.
-
Audit log
Administrative actions are recorded, so changes can be traced.
This website
- This information website has no user accounts and does not share sessions with the application.
- Fonts and scripts are served from this website itself; no third-party trackers are loaded.
- Contact form messages are sent by e-mail and are not stored on this website.
Not stated here
Certifications, compliance statements, hosting location, formal response times and retention commitments are not published on this page. Ask via the contact form if you need them.