Security Notice: Unauthorized Access via Third-Party Analytics Tool
On 3 August 2026, an attacker exploited a zero-day vulnerability in Metabase, a third-party analytics tool we use internally, and gained read-only access for approximately 26 minutes to a data warehouse holding a copy of Checkly operational data. Our production platform, including check execution and alerting, was not accessed, and Checkly secrets remained encrypted. Values stored directly in check configurations (custom headers, cookies, query parameters, authorization headers) and hashed OTEL API keys should be considered exposed. We recommend rotating any affected credentials. Metabase has patched the vulnerability and we have investigated the impact.
Full details and remediation steps are available in our blog post: https://checklyhq.com/blog/metabase-security-incident
API Outage
We have mitigated the issue and service has recovered.
Partial homepage outage & check scheduling delays
The issue has been resolved.
API 500 errors when updating or creating resources
The issue has been resolved.
Creating, updating, or cloning checks and check groups could have returned errors; running checks and alert notifications were unaffected.