Operator tier in Gotcha 0.4.12: hand monitoring to the team without handing out admin
The headline change in Gotcha 0.4.12 is an operator tier for project teams. While a single person runs the instance, permissions are a non-issue: the owner is the admin. But as soon as a team starts covering production, an unpleasant fork appears: either every on-call engineer gets org-wide admin, or every “pause that monitor, we’re deploying” goes through the owner.
That fork is now gone.
What a project team member can do
A team member gets the whole day-to-day monitoring routine — without being promoted to organization admin:
- uptime monitors: create, edit, pause and resume, delete;
- heartbeat: view and rotate the ping token;
- maintenance windows — so planned work doesn’t page anyone;
- status-page content;
- issue alert rules and metric alerts.
The typical “release day” sequence — pause the checks, open a maintenance window, put everything back afterwards — is now fully self-service for the team.
Where the line is drawn
Alert channels — the Telegram bot, SMTP, webhooks — stay with owners and admins. The reasoning: a channel’s recipient and secret (bot token, address, webhook URL) are credentials, not an operational setting. An operator sees the channel list and the delivery log, but recipients are masked, and channels cannot be created or changed.
Status-page publication and project/org settings also remain owner/admin — those are “what we show the world” decisions, not “how we run on-call”.
Security changes in the same spirit
Two more changes in this release follow the same line — fewer places where sensitive values sit in the open:
- Monitor headers are encrypted at rest. If an HTTP check sends an
Authorizationheader, its value is now stored the same way alert-channel secrets already were — encrypted. - Status-page addresses are now opaque keys like
/status/p_...instead of a human-chosen slug. Slugs were instance-wide: anyone could probe which names were taken by other organizations, and short names could simply be squatted. The key removes both problems; existing/status/<slug>links keep working via a 301 redirect, and the page’s public name is now its title.
Small things and fixes
- A Copy button on event pages: one click puts the event context on the clipboard — as Markdown or plain text. Handy for tickets, chats and prompts.
- Ingest gained memory protection for the case when ClickHouse is idle, honest queue and quota accounting, and per-organization attribution of dropped data.
- A corrupted channel secret is no longer treated as live — alerts are no longer lost on that path.
- Fixes for uptime check consensus, maintenance windows and OAuth invitations.
- Docs: the SDK section now covers the CMS extension family — WordPress, Joomla, 1C-Bitrix, Drupal, OpenCart, MODX and Tilda — and the installation guide gained an AlmaLinux/RHEL path.
Upgrading
The usual way: pull the new image and restart, migrations apply themselves — details in the upgrade guide. The release is cumulative and includes the docs-only 0.4.11.
The full changelog is in the GitHub release.