Repository navigation
docs: refresh state/architecture/competitors and add Site24x7 analysis - #9
Merged
Merged
Conversation
- database-model.md: update checks.status (1=created/3=up/4=down/7=degraded) and results.status (1=created..6=error) to match migration 002 lifecycle ordering, and drop unimplemented "betterstack" from integration_connections type list. - architecture.md: align Result status enum with new lifecycle order. - competitors/pingdom.md: clarify SolarWinds → Thoma Bravo/Silver Lake → Turn/River Capital ownership chain (PE acquisition closed Q1 2025). - README.md + conventions/event-colors.md: index the previously orphaned event-colors convention. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Site24x7 was the largest gap in the competitor coverage: listed in full-list.md as Tier 1 mid-market but no dedicated analysis. Adds a full breakdown (100+ monitor types, 130+ probe locations, OAuth 2.0 API, 8-pack pricing, AIOps), positioning notes vs. Pingdom / Datadog / UptimeRobot, and a SolidPing learning list (anomaly detection, multistep API checks, mobile app, MSP mode, status-page subscribers). Updates README, full-list (deduped + cross-linked), and adds a "see also" pointer in comparison.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
fclairamb
added a commit
that referenced
this pull request
Jul 22, 2026
) Logs the 2026-07-21 net-new competitor surfaced by the marketing-listening pipeline. **UptimeMonitoring.com** (by Monitive) — first MCP-**first** rival: the product is built around creating/managing monitors by asking Claude/ChatGPT/Cursor via an MCP server. 22 global probe locations with cross-region confirmation. HTTP-only, SaaS-only (not self-hostable), Free ≤50 monitors / 60s / 30-day retention, no email alerting. Surfaced via Show HN (48919840). Significance: MCP is now contested table-stakes, not a differentiator — hold "self-hosted MCP" and lean on the real moat (32 check types vs HTTP-only, OSS self-host vs SaaS, built-in on-call). Changes: - `wiki/competitors/indie-watch.md` — new tracked entry - `wiki/competitors/positioning.md` — caveat added to messaging hook #9 (AI-native) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
1 of 4 tasks
fclairamb
added a commit
that referenced
this pull request
Oct 11, 2026
## What & why Deals with every open alert on the Security tab. **Fixed in this PR** - Dependabot #9: `github.com/moby/go-archive` v0.2.0 → v0.3.0 (tar archive can write outside the extraction dir). - Dependabot #10: `github.com/moby/sys/user` v0.4.0 → v0.4.1 (unbounded parsing DoS). - CodeQL #65 (clear-text logging, grdp `sec.go`): `sendFlagged` logged the plaintext PDU in hex at debug level, and the client info PDU carries the RDP password. It now logs the length only. Also removed the debug logs of the client random and the four NTLM signing/sealing keys (same class of leak, not flagged). - CodeQL #61 (allocation-size overflow, `credentials/secret_fields.go`): map size hint is now `max(a, b)` instead of `a + b`. Same change on `MergePatch`. **Dismissed (no code change)** - #72-#81, #68-#71 (weak crypto / weak hashing in vendored `third_party/grdp`): RC4, MD4, MD5, SHA-1 and DES are mandated by RDP standard security and NTLM. Same reasoning as the VNC DES alerts #94/#95. - #31 (MD5 in `checksip`): SIP digest auth (RFC 3261/2617) is MD5. - #33 (SHA-256 on password, `passwords/bcrypt.go`): pre-hash before bcrypt to bypass the 72-byte limit. bcrypt is the slow hash. - #54 (InsecureSkipVerify, `checkrdp`): leaf-only certificate inspection by design, same as #62/#93. - #47/#48 (cookie Secure, `statuspagelock`): `Secure: httpx.IsTLS(req)`, same as #44/#59. - #39 (request forgery, `jmap/client.go`): the JMAP session URL is set by a super admin (instance operator), and reaching their own mail server, often on the LAN, is the feature. Same as the Freebox alert #35. - #17 (clear-text logging, `slack/commands.go`): map-value taint through the check config, the password never reaches the log. Same as #18. ## How to test - `go build ./...` and `go test ./internal/crypto/credentials/ ./internal/checkers/checkrdp/...` in `server/` - `go test ./...` in `server/third_party/grdp` - `golangci-lint` v2.14.0 on `internal/crypto/...`: 0 issues ## Checklist - [x] `go build`, lint and tests pass on the touched packages (full `make test` left to CI) - [ ] Tests added or updated for the change (log-only and size-hint changes, existing tests cover behaviour) - [ ] Docs updated (not user-visible) - [ ] Schema changes (none) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two-commit docs refresh covering project state, architecture, and competitor coverage.
Commit 1 — refresh state enums, integrations, and competitor ownership:
database-model.md: realignchecks.status(1=created/3=up/4=down/7=degraded) andresults.status(1=created..6=error) to migration 002 lifecycle ordering; drop unimplementedbetterstackfrom the integration_connections type list.architecture.md: align Result status enum with new lifecycle order.competitors/pingdom.md: clarify the SolarWinds → Silver Lake/Thoma Bravo → Turn/River Capital ownership chain (PE acquisition closed Q1 2025).README.md+conventions/event-colors.md: index the previously orphaned event-colors convention.Commit 2 — add Site24x7 competitor analysis:
competitors/site24x7.md(~340 lines): 100+ monitor types, 130+ probe locations, OAuth 2.0 API, 8-pack pricing, AIOps, positioning vs Pingdom/Datadog/UptimeRobot, and a SolidPing learning list (anomaly detection, multistep API checks, mobile app, MSP mode, status-page subscribers).full-list.md,README.md, andcomparison.md.Test plan
docs/database-model.mdand confirm status-enum tables read cleanlydocs/competitors/site24x7.mdand confirm tables/sections render