Snapshot 13128
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Trust Center Start your security review View & download sensitive information Ask for information Welcome to the Dash0 Trust Center! This is where we show our work: how we secure your data, what compliance certifications we hold, and how our infrastructure is actually built. We'd rather you verify this yourself than take our word for it: browse our SOC 2 report, subprocessor list, and security practices below. Compliance GDPR SOC 2 Type 2 HIPAA ISO/IEC 27001 PCI DSS dash0 is reviewed and trusted by Zalando Bridgestone Corporation The Telegraph Chargetrip Eventlink Linearity Tessl NO GA EVgo NextRoll AUTONATIVE Documents REPORTSNetwork Diagram REPORTSPentest Report REPORTSSecurity & Compliance Program Overview REPORTSSecurity Whitepaper REPORTSSOC 2 Report REPORTSVulnerability Assessment Report COMPLIANCEHIPAA COMPLIANCESOC 2 Type 2 APP SECURITYApplication Penetration Testing LEGALCyber Insurance LEGALService-Level Agreement DATA PRIVACYData Protection Impact Assessment (DPIA) Risk Profile Impact LevelSevere Recovery Time Objective24 hours Recovery Point Objective24 hours View more Product Security Data Security Multi-Factor Authentication Role-Based Access Control View more Reports Network Diagram Pentest Report Security & Compliance Program Overview View more Self-Assessments We are working on our security compliance. We can provide completed questionnaires upon request. Please refer to your account manager for more information. Data Security Data Backups Encryption-at-rest Encryption-in-transit View more App Security Responsible Disclosure Code Analysis Credential Management View more AI AI Training Data and Bias AI Security AI Risk Management Legal Subprocessors Cyber Insurance Data Processing Agreement View more Data Privacy Cookies Data Protection Impact Assessment (DPIA) Access Control Data Access Logging Password Security Infrastructure Status Monitoring Network Time Protocol Separate Production Environment Endpoint Security Disk Encryption Mobile Device Management Threat Detection Network Security Firewall Corporate Security Email Protection Employee Training Incident Response View more Policies Access Control Policy Business Continuity/Disaster Recovery (BC/DR) Policy Data Classification Policy View more Security Grades Qualys SSL Labs dash0.com app.dash0.com Trust Center Updates Security Updates General Vulnerability Affecting Dash0 Affected customers were notified directly on June 19, 2026. On June 18, 2026, Dash0 identified and resolved a security vulnerability affecting ingest-only auth tokens. We have not found evidence of successful exploitation but recommend rotating any credentials accessible through publicly exposed ingest-only tokens related to synthetic API checks and notification channels, and reviewing your audit logs for suspicious activity. Credentials stored in integrations as well as telemetry data have not been affected by this vulnerability. What Happened On June 18 at 14:53 UTC, we were notified by an external security researcher of an exposed auth token that could be used to access tenant configurations beyond its intended scope. Upon investigation, we identified a vulnerability in our permission validation logic — ingest-only auth tokens, intended solely for sending telemetry data, had unintended read and write access to tenant configurations, including notification channels, check rules, dashboards, and teams. We confirmed and contained the initial report by 15:35 UTC the same day and deployed a full fix by 18:24 UTC. We have confirmed the issue is fully resolved. Who Is Affected This vulnerability applies to ingest-only auth tokens that were publicly exposed — for example, embedded in frontend code or public repositories. If your ingest-only tokens were kept private and treated like any other write-enabled token, your risk is minimal. We reviewed audit logs for all affected tokens and found no evidence of malicious activity. Credentials stored in integrations as well as telemetry data have not been affected by this vulnerability. What You Should Do If you have ingest-only tokens that were publicly exposed: Review any credentials accessible through your ingest-only token — including those stored in synthetic API checks and notification channels — and rotate those as a precaution. Review your audit logs for any unexpected activity. If you are seeing broken workflows (e.g. operator deployments, CLI or Terraform provider usage) following our fix shipped on June 18: create a new token with the exact permissions your workflow requires. That will resolve it immediately. If you are unsure whether you are affected, reach out to security@dash0.com and we will help you check. What We've Done June 18, 15:35 UTC — Disabled the initially reported token and RCA kicked off. June 18, 17:04 UTC — Reviewed access logs and found no evidence of malicious use of affected ingest-only customer tokens. June 18, 18:24 UTC — Deployed a fix across all API endpoints. June 19, 12:30 UTC — Proactively reached out to customers known to be impacted. June 25, 11:20 UTC — Published to trust center. A full root cause analysis is underway and we are evaluating additional controls to detect and prevent similar misconfigurations before they reach production. Gratitude We'd like to thank Nickita Khylkouski from Peak Security for responsibly disclosing this finding. If you have any questions, reach out to security@dash0.com.