Security and Privacy

You stay in controlCopy Anchor Link

• You approve each connection and choose the single project it can read.
• Read-only. There is no tool that writes, triggers runs or consumes quota.
• Disconnect works immediately. Remove an app under Connected apps.
• Your role applies on every call. Access is re-checked for each request, not only when you connect, so these take effect at once:
  • you disconnect the app
  • you are removed from the organization (if you are removed only from the project, you keep read-only access as a viewer while you remain in the organization)
  • your account is banned (and the ban has not expired)
  • your role can no longer view that kind of resource

Sign-in designCopy Anchor Link

What is filteredCopy Anchor Link

• Test scripts, variable values, alert settings and monitor configuration are never returned.
• Monitor targets are reduced to scheme and host, so URLs that hide a secret in the path or query stay hidden.
• Text is scanned for credentials (tokens, API keys, Authorization and cookie headers, URL passwords) and replaced with [REDACTED…] markers (including Supercheck's own API keys and email addresses), and long fields are cut off with [truncated].
• Requests over 1 MB are rejected.

Prompt injectionCopy Anchor Link

Tests, logs and incidents can contain text written by someone else. Tool descriptions tell the AI to treat it as data. Keep that in mind when you give an AI tool other tools that can act (for example shell or deploy access), and review its actions.

LimitsCopy Anchor Link

Each connected app may send up to 300 requests a minute, and all of your connected apps together up to 600 (every call in a batch counts as one request). An app may have at most 4 requests running at a time, and you at most 8 across your apps. A batch carries at most 20 calls. Over a limit, the server answers 429 with Retry-After. If the rate limiter itself is unavailable, it answers 503 with Retry-After and still refuses the call; an outage never lifts a limit.

Resetting your password signs you out everywhere and disconnects every connected app, including one you reconnect before the cleanup has finished. Reconnect the ones you still use. If the cleanup cannot finish straight away it is retried automatically every hour. Job trigger keys used by pipelines are not affected.

AuditCopy Anchor Link

Tool calls (user, app, project, duration) and access-denied events (user, app, reason) are written to the audit log on a best-effort basis. Arguments and results are not stored.

OperatorsCopy Anchor Link

MCP is off unless MCP_SERVER_ENABLED=true. See Self-Hosted for the settings and proxy requirements.