rails/cve.
Menu

YOUR SIGNAL STATION

Sign in. Subscribe.
Keep the log.

A workspace holds your apps, addresses, signing secrets, and delivery history. It is private to you.

Signing in

Management token. Creating a workspace gives you a token starting with rcve_, shown once. Paste it at Restore access from any browser. Treat it like a password.

GitHub. This deployment offers Continue with GitHub. Sign-in uses your numeric GitHub ID, requests no repository access, and installs nothing. To link GitHub to an existing token workspace, restore the workspace first and use Connect GitHub in Settings. Signing in with GitHub before linking creates a separate empty workspace; accounts are never merged by email address.

Browser sessions last 30 days. Sign out ends only the current browser’s session.

Settings

  • Secure your account replaces the management token and signs out every other device. Prove it is you with the current token or a fresh GitHub confirmation. You can drop an unexpected GitHub link at the same time. GitHub-created workspaces can generate a token here as a second way in.
  • Notification addresses holds up to five verified addresses. Removing one cancels its pending deliveries and clears it from apps that used it.
  • Delete workspace removes everything in one step after you prove ownership and type DELETE. In-flight sends cannot be recalled.

If you lose the token and have no GitHub link, the workspace cannot be recovered. A notification address is not a sign-in.

App status

  • active delivers on every enabled channel.
  • paused holds everything until you resume.
  • Needs destination means no verified webhook and no verified address is selected.
  • Delivery unavailable means the deployment has that channel disabled, for example no egress gateway for webhooks.

Names are labels, not filters. Every active app receives every future advisory. Editing the webhook URL issues a new secret and needs a new handshake. Deleting an app removes its secret and history.

Delivery log statuses

StatusMeaning
pendingWaiting for the next five-minute run.
sendingPicked up by a run. Released after two minutes if interrupted.
retryThe last attempt failed. Next attempt after 5, 10, 20, 40, 80, 160, or 320 min.
deliveredYour webhook returned 2xx.
acceptedThe email provider accepted the message. Inbox arrival is not tracked.
failedEight attempts without success, or the event was too large to send.
cancelledThe channel or destination was removed or changed first.

Delivery is at least once: a receiver can accept a request just before the connection drops, and the same event is sent again. Email and webhook attempts are independent. Completed history is kept for at least 30 days.

Limits

Ten apps and five addresses per workspace. Hourly budgets cover sign-ups, verifications, handshakes, tests, and deliveries; exceeding one returns a 429 with Retry-After.

Open settings →