Security

This app holds a credential for your EVE account. You should not have to take that on faith, so here is what it runs on, what it does with the credential, and what it cannot do with your account.

The life of a token

  1. Step 01

    You sign in on CCP's page

    EVE SSO, on eveonline.com, with PKCE. Your password is typed into CCP's form and never reaches this server, which only ever receives a token in exchange.

  2. Step 02

    The token is encrypted before it is stored

    AES-256-GCM, with a key held in the server's environment. It is encrypted in memory and written to Postgres already encrypted, so the ciphertext is what sits on disk and in every backup.

  3. Step 03

    It is decrypted only to make a poll

    Held in memory for the length of one ESI request, then dropped. It is never logged, never returned by an API, and never sent to your phone.

  4. Step 04

    You can end it without asking me

    Revoke the application in your EVE account settings and the token dies at CCP's end the same minute, whatever this server still holds.

What the server is allowed to do

EVE SSO grants scopes, and this application asks for four. Every one of them is read-only. There is no scope here that can undock a ship, move an asset, accept a contract, or spend a single ISK, because those scopes are never requested and CCP would reject the attempt if they were.

  • esi-skills.read_skillqueue.v1
  • esi-industry.read_character_jobs.v1
  • esi-planets.manage_planets.v1
  • esi-corporations.read_structures.v1

What it runs on

Poller
Go, a single static binary in a small container. It holds the tokens and polls ESI on a schedule; your phone never polls anything.
Database
Postgres, on the same private network as the poller. Not reachable from the internet.
This website
Next.js, reading and writing the same database. It never creates or alters tables: the poller owns the schema outright.
Push
APNs and FCM directly. No third-party push service sits in the middle, so no vendor sees your alerts.
Hosting
A bare-metal Ubuntu server running Docker behind Traefik, with TLS from Let's Encrypt. Images build to a private registry and deploy only from a tagged release.
Secrets
Environment variables, never files in the repository. The encryption key exists in exactly one place and is not recoverable from a backup of the database alone.

Encryption, specifically

Refresh tokens are encrypted with AES-256-GCM, an authenticated cipher, so a token that has been tampered with fails to decrypt rather than decrypting into something wrong. Each token gets its own random nonce.

Two separate codebases write to that column, the Go poller and this website, which makes the encryption format a contract between them rather than an implementation detail. It is pinned by committed test vectors and by a check that encrypts in each stack and hands the bytes to the other. That check exists because vectors alone would keep passing if one side's encryption drifted, and every newly written token would quietly become unreadable.

Being a good citizen of ESI

Third-party tools get banned from ESI for hammering it. Evepraisal was a staple for a decade and died in 2023 when its IP was blocked. So polling here happens on each endpoint's own cache expiry rather than in a tight loop, the error-limit headers CCP returns are honoured, and a global circuit breaker stops all outbound requests if the error budget runs down.

This is a reliability property as much as a courtesy one: an app that gets itself blocked stops paging you.

Why the source is not public

Fair question, and the honest answer is competitive rather than technical. Nothing currently serves this niche, and publishing the source hands a working version of it to anyone who wants to ship first. That is the whole reason.

It is a real trade, and worth naming rather than dressing up: reading the code is the strongest way to check a claim, and closing it means this page has to be taken on trust instead. What does not require trusting me is the part that matters most, which is that access lives in your EVE account settings and you can revoke it there at any time.

Reporting something

If you find a security problem, mail [email protected] directly rather than posting it publicly, and it will be dealt with before anything else. For what is stored and for how long, see privacy.

Last updated 25 July 2026