Security & data handling

Public pages, a watch list, and a tamper-evident record.

Dormouse watches public web pages. The data it stores is mostly copies of those already public pages, plus your list of which URLs to watch, plus metadata about when checks ran and what changed.

It stores no page credentials and no personal data beyond whatever a watched public page itself contains. Delivery credentials and API tokens are never written to the database.

It never silently misses.

• Cumulative diff. Every check compares the page against the last version we successfully captured, so a change is caught whenever we next look, no matter how long the gap.
• No false baseline. A failed check is recorded as a gap and never becomes the point of comparison, so the full change since the last good capture is reported when the source recovers.
• Gaps are findings. A watchdog raises an alert when a source goes too long without a successful check. You are never told "all clear" when we could not look.

The one thing a fixed interval cannot see is a change that appears and disappears entirely between two checks; for sources where that matters, the interval is shortened, and the coverage report shows the actual cadence against the promised one.

Credentials stay out of the command line and off disk.

• API token is read from the DORMOUSE_API_TOKEN environment variable and compared in constant time.
• Delivery credentials (SMTP password, Twilio token) are supplied by ${VAR} environment references in the notifier configuration, so the literal secret never appears in process arguments or shell history.
• Errors are redacted so a malformed configuration can never print a secret to a log.

Credentials live only in process memory for the lifetime of a run.

Encrypted at the volume, verifiable at the record.

State lives in a single database file. For deployments under an encryption-at-rest control, Dormouse runs on an encrypted volume (LUKS, FileVault, an encrypted EBS volume), which covers the database, its write-ahead log, and exports uniformly and is the standard auditable approach. The file is restricted to the service account.

The integrity guarantee is stronger than storage encryption: every page snapshot is addressed by the hash of its content, and every check is chained to the previous one, so tampering is detectable, not merely discouraged. How the proof works.

Outbound by default; the one inbound surface is read-only.

• Outbound HTTPS only, to the watched pages and your configured delivery endpoints, with per-host request spacing.
• Inbound is limited to an optional read-only JSON API that binds loopback by default, requires a bearer token, and expects TLS to be terminated by a proxy in front of it.

One static binary, source available.

Dormouse is a single static binary with a small, pinned dependency set and no cgo. Because it is source-available under the Business Source License, your engineers can read exactly how it fetches, stores, and verifies — including the integrity code itself. Run it self-hosted on your own infrastructure, or let us run it for you as a managed service.

Report a vulnerability.

Report suspected vulnerabilities privately to [email protected]. We acknowledge within three business days and keep you updated through remediation.

Fuller detail lives in the SECURITY.md that ships with the engine.