v1.4 doesn't add anything you can click on. It's a testing pass over the Go backend — the part of Checkmeup that handles auth, billing, and your monitor data — and it's worth a post because of what it found, not what it adds.
What got tested
Roughly 190 test cases went in across auth, billing, maintenance windows, cron and SSL monitors, the public ping endpoint, settings, and status pages — all running against a real Postgres instance, not mocks. That's the bulk of the API's HTTP handlers now covered, up from essentially nothing beyond the auth middleware.
The security fix
The one worth being upfront about: the endpoint that attaches a monitor to a status page checked that the monitor type and ID were well-formed, but never checked that the monitor actually belonged to your account. In theory, if you knew or guessed another account's monitor ID, you could have attached it to your own public status page and had their monitor's live status show up on it. I found this while writing tests, not from a report, and have no evidence it was ever used that way. It's fixed — status pages now verify ownership before attaching a monitor — and a test pins that behavior so it can't quietly regress.
Other fixes along the way
- Sign-up now rolls back cleanly if account creation fails partway through, instead of leaving an orphaned record behind.
- The LemonSqueezy billing webhook is more defensive: it no longer silently drops a failed plan update, and it rejects requests instead of accepting them unsigned if the webhook secret is ever misconfigured.
- A cron monitor with alerts turned off now correctly clears its incident history on recovery, instead of looking permanently "down" in the data even after it checked back in.
- The "upgrade to add more" prompt on plan limits now shows up consistently on edit screens, not just when creating something new.
Why blog about tests
Checkmeup is a one-person product handling other people's monitoring and billing data, so a pass like this is exactly the unglamorous work that keeps it trustworthy. I'd rather post about it plainly than only ever talk about new features.
Follow along
Releases land here on the blog. The GitHub repo has the full commit history and architecture decision records if you want the why behind any of this.
— Andrew