Security Notice: Unauthorized Access via Third-Party Analytics Tool

What to do

• Check whether your product depends on Checkly. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-08-10 18:42 UTC and 2026-08-10 18:42 UTC may need a replay.

• Subscribe to Checkly's feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=checkly works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Checkly 1

1. resolvedAug 10, 2026, 6:42 PM UTC

   Status: Resolved On 3 August 2026, an attacker exploited a zero-day vulnerability in Metabase, a third-party analytics tool we use internally, and gained read-only access for approximately 26 minutes to a data warehouse holding a copy of Checkly operational data. Our production platform, including check execution and alerting, was not accessed, and Checkly secrets remained encrypted. Values stored directly in check configurations (custom headers, cookies, query parameters, authorization headers) and hashed OTEL API keys should be considered exposed. We recommend rotating any affected credentials. Metabase has patched the vulnerability and we have investigated the impact. Full details and remediation steps are available in our blog post: https://checklyhq.com/blog/metabase-security-incident

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.