A clear boundary between public content and private operations.
WordPress publishes marketing and documentation. The monitoring application owns customer identity, organizations, probes and billing. Customer passwords are not copied into WordPress.
Public self-service requires authorization checks on every route and action, validated outbound targets, rate limits, protected credentials and verified recipients. Signup remains gated while this review is incomplete.
Report a suspected issue through the support path without sending passwords, access tokens or customer payloads. No independent certification, penetration-test pass or contractual security guarantee is claimed.