Skip to content

Security

A SIP account that can register can usually place calls, so a leaked credential is toll fraud billed to you, not an information disclosure. This page describes what SIP Sentry does about that, precisely enough to check.

Signing in

  • No passwords. You sign in with a single-use link emailed to you, valid for 20 minutes, or with a passkey (WebAuthn).
  • Sessions live in an HttpOnly, SameSite=Lax cookie for 30 days. We store only a SHA-256 hash of the session token, and every state-changing request in a session must carry a matching CSRF token.
  • Sign-in endpoints are rate-limited per IP address.

SIP credentials and channel secrets

  • The password of a REGISTER or RTP test account, and every alert channel secret (webhook signing secret, Slack webhook URL, Telegram bot token, SMS gateway key), is encrypted with AES-256-GCM as it arrives. The key lives outside the database, and the API will not start without it: there is no silent fallback key.
  • These fields are write-only. No endpoint returns them and they are never logged.
  • A SIP credential belongs to your organization and can be narrowed to one customer. The API refuses to attach it to another customer’s monitor.
  • A credential is decrypted only when a check is dispatched, and travels to the probe inside that job over WSS.
  • Results keep the SIP trace, including the digest exchange, so a realm or nonce problem can be debugged. The password never appears in a trace, but a digest response can be attacked offline if the password is weak, so give the test account a long random one.

Use a test account that cannot make calls

None of the above helps if the account on the other end can dial premium-rate numbers at 3 AM. Point REGISTER and RTP checks at a dedicated test extension and bar it from outbound calls. See REGISTER check safety and RTP / MOS check safety.

Probes

  • Outbound-only: a probe dials the API over WSS and needs no inbound port, VPN or port forward.
  • A probe token is shown once. We keep only its SHA-256.
  • A probe has no database and writes nothing to disk. It holds a job’s credentials in memory for the length of that check.
  • The wire format is documented in Probe protocol.

Webhook signatures

When a webhook channel has a signing secret, every request carries:

X-SipSentry-Event: down
X-SipSentry-Signature: sha256=<hex HMAC-SHA256 of the raw request body>

Compute the HMAC-SHA256 of the raw body with your secret and compare it with the header in constant time before acting on the payload.

Public status pages

A status page shows the names, check types, states and uptime of the monitors you choose to publish. Targets, addresses and check results stay private.

Reporting a vulnerability

Email hello@sipsentry.net with what you found and how to reproduce it. Please give us the chance to fix it before you publish, and test only against your own account and infrastructure.