Security

What we do to protect your account and data. CronPup is a small, young service, so this page says plainly what is and isn't in place.

Accounts

• Passwords are hashed with PBKDF2-SHA256 (100,000 iterations, the maximum Cloudflare Workers allow, per-user salt).
• Optional two-factor authentication (TOTP) works with any authenticator app.
• Sessions use HttpOnly, SameSite cookies (Secure over HTTPS); changing your password signs out other sessions, and Settings has a button to sign out everywhere else.
• Failed logins are rate-limited per IP address and per account.
• API keys and reset/confirmation tokens are stored only as SHA-256 hashes.

Web application

• A strict Content Security Policy with no JavaScript at all, plus CSRF tokens on every form, HSTS and anti-framing headers.
• Outbound requests (webhooks, ntfy, TLS checks) run from Cloudflare's network, which can't reach private networks; private and local addresses are refused when you add them, redirects aren't followed, and every outbound request has a hard deadline.
• Webhooks are signed (timestamped HMAC-SHA256), so you can verify they came from us.

Data

• We store your email, your monitors and their recent signals (up to 10 KB of output per ping), for your plan's retention period.
• The database has point-in-time recovery for the last 30 days (Cloudflare D1 Time Travel). Nightly off-site exports are being set up.
• You can download all your data (JSON) or delete your account at any time from Settings. Deletion is immediate and also cancels your subscription.
• No third-party trackers. Page views are counted in aggregate, without cookies or IP addresses.
• Card payments are handled entirely by Stripe. We never see card numbers.

Testing

The code has an automated test suite. CronPup was rebuilt on Cloudflare in November 2026; the previous version was reviewed in three independent audit passes, and the rebuilt version had its own independent review in November 2026 (12 findings: 11 fixed, 1 scheduled).

Reporting a problem

If you find a vulnerability, please report it privately at support@cronpup.com before disclosing it publicly.