Uptime Kuma: Self-Hosted Uptime Monitoring and Status Pages (GitHub, Scanned)

Uptime Kuma is a self-hosted alternative to services like UptimeRobot. It checks your websites, APIs, servers and services as often as every 20 seconds, over HTTP, TCP, ping, DNS, WebSocket, keyword and JSON-query checks, Docker container status, game servers and push heartbeats, and tells you the moment something goes down. Alerts go out through more than 90 services, including Telegram, Discord, Slack, email and Pushover.

It is known for being pleasant to use: a fast, reactive dashboard with response-time charts and certificate expiry warnings, plus public status pages you can map to your own domain to show customers what is up. Setup is one Docker command and everything is configured from the browser, with two-factor login available.

It is MIT-licensed, with about 92,600 stars and 1,145 contributors, at version 2.5.6 when scanned. Version 2 is the current line, and the project has a live demo that resets every ten minutes.

• Repository: github.com/louislam/uptime-kuma
• Licence: MIT (MIT License)
• Language: JavaScript. Stars: 92.6K. Forks: 8,569. Last push: Oct 19, 2026.
• Scan: safe, Oct 19, 2026, commit b092505

Who it is for

Home-lab users, freelancers and small teams who want to know when a site or service goes down without paying for a monitoring subscription, and who can keep one small server or container running.

Getting started

1. Run it with Docker, reachable only from this machine

docker run -d --restart=always -p 127.0.0.1:3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2

2. Open the dashboard and create the admin account

open http://localhost:3001

The README's own command publishes port 3001 on every network interface; the version above keeps it on localhost until you put it behind a reverse proxy. Keep the data on a local disk or volume, since NFS is not supported. A Docker Compose file and a Node.js install without Docker are in the README.

Safety scan

We cloned louislam/uptime-kuma at commit b092505 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• The 11 secret hits are placeholders: the text BEGIN PRIVATE KEY shown as a hint in the SMTP and SFTP forms, its translations, and a test key for the SFTP monitor. No committed binaries and no bare-IP URLs across 819 files and about 154,000 lines.
• The one pattern hit is a curl | bash for the NodeSource setup script inside a Dockerfile used to build a helper image. It runs at image build time, not on your machine.
• 62 known advisories (3 critical, 27 high) in package-lock.json. Of the criticals, shell-quote is a development dependency; tar is used only by a script that downloads the front-end build; and proxy-addr, through Express, concerns trusted-proxy subnet lists, while Uptime Kuma's reverse-proxy setting is a yes or no. Many of the highs (undici, busboy) sit in test containers. Updating to each new release is still the right habit.
• The many outside hosts are its notification providers, from Telegram to regional SMS gateways, which it contacts only when you configure them.
• 21 workflows; nine use pull_request_target, and none checks out PR code: they label, comment, or check PR titles and descriptions. 26 of 28 third-party actions are pinned to commits, and CodeQL and Dependabot are on. Licence, security policy, contributing guide and code of conduct present.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: JSON 69.5K, JavaScript 45.9K, Vue 31.2K, TypeScript 1,992, YAML 1,970, Markdown 1,649.

Questions

Is Uptime Kuma free?

Yes. Uptime Kuma is MIT-licensed and free to self-host, with no limits on monitors or status pages. The only costs are the machine it runs on and any paid notification service you choose, such as SMS.

Should I run Uptime Kuma on the server it monitors?

Better not. If that server goes down, the monitor goes down with it and cannot alert you. A small VPS, a Raspberry Pi at home or a different cloud region is a better place for it.

Can Uptime Kuma make a public status page?

Yes. You can create several status pages, choose which monitors each shows, and map them to your own domain, so customers can check whether a service is up without logging in.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.