Safe probes
Blocking localhost, private and special IP ranges, metadata endpoints and DNS rebinding.
Security
Monitoring should not create a new security gap.
UPnator limits trust between services, blocks unsafe public-probe targets and requires extra confirmation for sensitive operations.
✓Layered defensemTLS · SSRF guard · step-up · audit
Four layers
Protection for the target, transport, identity and changes.
Service identity
mTLS limits execution traffic to authenticated platform components.
Strong authentication
TOTP, passkeys, enterprise OIDC and fresh step-up for sensitive operations.
Audit and least privilege
Organization roles, scoped API keys, expirations and action history limit the impact of mistakes.
Firewall and WAF
View IPv4 addresses →A protected target must recognize all three public probes.
If inbound traffic is denied by default, allowlist UPnator source addresses only on the monitored port. The complete current list is maintained in the documentation.
Separation
The public status page does not reach into the platform database.
The renderer receives a signed snapshot and serves it without access to PostgreSQL or NATS. Public communication stays separated from the control plane.
Control planesigned snapshot →Renderer→ HTTPS →Visitor
Launch checklist
Six actions for an organization owner.
- 1Enable a passkey or TOTP
Secure owner and admin accounts first.
- 2Limit administrative roles
Grant permissions according to actual responsibility.
- 3Allowlist public probes
Open only the monitored port to all three source IPv4 addresses.
- 4Test alert channels
Do not consider setup complete without confirmed delivery.
- 5Grant minimal API scopes
Set expirations and rotate service-account keys.
- 6Review audit history
Regularly review security, team and automation changes.
Security question
Contact usNeed a flow description or Private Agent deployment guidance?
Describe the environment and required trust boundaries. We will respond with a concrete architecture.