Security
How traffic travels through FastDog and what the connector does.
How encryption works
TLS for your hostname terminates at the FastDog edge. The edge handles requests as plain HTTP before sending them through an encrypted WebSocket tunnel (wss) to your connector. The connector connects to your app using the scheme you configure: HTTP or HTTPS. HTTPS requests to your app verify its certificate.
Certificates are issued automatically for verified hostnames after DNS routing and ownership checks.
What the connector can see
The connector forwards full requests and responses, including headers, cookies, authorization headers and bodies, plus WebSocket messages. Streaming requests pass through in chunks; older buffered requests are kept whole in memory.
It knows its connection token, name, hostname, app address and edge addresses. Registration sends its name, hostname and app address to the edge. Requests go to the one app address you configure; incoming paths and queries cannot choose a different destination host. Your app receives the visitor’s Host header.
Every 20 seconds, a heartbeat reports the connector version and the result and time of a HEAD health probe of your app. This health probe skips certificate verification; forwarded HTTPS requests do not. If the app cannot be reached, the connector returns an error to the edge.
What it stores and does not do
The connector itself writes nothing to disk. It keeps its token in memory and sends it in an Authorization header, never in a URL. Your installation supplies the token; Docker administrators can inspect the container environment. Protect saved credentials and replace the token if it leaks.
Its logs contain connection status and configuration errors, not request contents or tokens. It reads its package metadata to report its version; it does not read your app’s files, run programs or update itself. It sends no telemetry beyond registration and the heartbeat described above.
It opens outbound connections to the configured edge and app, never a listening port. It carries HTTP(S) and WebSockets, not raw TCP, UDP or CONNECT tunnels. Edge redirects are not followed. If the tunnel drops, it reconnects with backoff.
See our Privacy Policy for service data handling.
Open source
The connector is open source under Apache-2.0 at fastdognetworks/fastdog-agent. The published image is ghcr.io/fastdognetworks/fastdog-agent:0.2.3; you can check the code it runs.
Reporting a vulnerability
Email support@fastdognetworks.com. Please don’t include live credentials or customer data.
Coming soon
Two-factor sign-in for the portal and an account audit log are coming soon. They are not available today.