Security

We track tanks for a living. So a tank-gauge hacking warning got our attention.

June 4, 2026

On June 2, CISA — along with the FBI, NSA, the Department of Energy, the EPA, and a handful of other agencies you don't usually see sharing a byline — put out a warning: attackers are going after automatic tank gauges, the devices bolted onto fuel and liquid storage tanks that report how full they are.

We build software that helps people keep track of their tanks. So yeah, the headline stopped us mid-coffee.

Here's what we want to be straight about up front: the warning isn't really about us. And we spent a couple of days auditing ourselves against it anyway. Let me explain both halves of that.

What CISA actually said

Automatic tank gauges (ATGs) are physical hardware — picture the Veeder-Root box wired into the tanks under a gas station. A lot of them got connected to the internet over the years so operators could read levels from anywhere. Convenient. Also, it turns out, a great way to let a stranger on the other side of the planet poke at the thing sitting on your fuel.

CISA is blunt about the damage. An attacker who gets in can fake the tank readings, silence the alarms, and even reach the pumps and valves. The advice boils down to three moves:

1. Get these devices off the open internet. Firewall them, put them behind a VPN, whatever it takes — just don't leave them sitting there with a public address.
2. Lock down the credentials. No default passwords. Real multi-factor auth wherever you can manage it.
3. Watch your logs. Specifically, watch for someone quietly changing an alarm threshold, renaming a tank, or otherwise fiddling with the system.

Why it's not (quite) about us

Top Off Time isn't an ATG. We're software. There's no serial port, no pump control, no box bolted to a tank with its own IP address. The literal advice — "firewall port 10001," "patch your gauge's firmware" — doesn't map onto us, and we're not going to pretend it does.

But two things make this more than someone else's problem.

First: our users are exactly the people CISA is talking to. Propane on the farm, diesel for the equipment, heating oil in the basement, fuel at the shop — Energy and Agriculture are named right there in the warning. If you've ever been told to pull your tank monitoring off the internet, honestly, that's kind of our whole pitch: you get the visibility without an exposed device on your network.

Second: the principles apply to a web app just fine. "Don't let someone silently change an alarm threshold and cover their tracks" is good advice whether that alarm lives in a steel box or a database. So we took the warning as a nudge to grade our own homework.

What we checked — and what we fixed

We didn't skim it and nod. We went down CISA's list item by item and mapped each one to our own code. The honest results:

The break-in stuff: we were in good shape. The attacks CISA cites — password bypasses, injection, privilege escalation — are web-app fundamentals, and we'd already been through several security passes on them. No default passwords, nowhere for an attacker to inject commands, admin access locked down tight. Good.

The watch-your-logs stuff: we had gaps. This is the part we're glad we looked at. A few things that should leave a trail weren't:

• When someone changed a low-tank alert threshold or renamed a tank, we weren't recording who did it, or when. Now we are.
• Our system already noticed suspicious readings — a level that jumps 40% with no fill, a rapid-fire burst of entries — but it quietly filed them to a dashboard nobody watches in real time. Now they set off an alert the moment they happen.
• In theory, you could go back and quietly rewrite an old reading. Not anymore. Edits are now limited to the last few days — which is all anyone legitimately needs to fix a typo — and older history is locked down.

A handful of smaller hardening bits went in alongside those. None of it was dramatic. That's sort of the point: security work that feels dramatic usually means you waited too long to do it.

The part where we don't slap a badge on it

Here's where a lot of companies would put a "CISA Compliant!" banner on the homepage. We're not going to, because there's no such thing. This was voluntary guidance aimed at hardware operators — not a certification — and CISA doesn't endorse products. Anyone selling you a "CISA certified" sticker is, well, selling you something.

What we'll say instead, and mean: we hold our tank monitoring to the same principles CISA is asking ATG operators to follow — log the changes that matter, watch for tampering, keep access least-privilege. We've still got a couple of items on our own list (app-level MFA on our admin accounts, a dependency refresh) before we'd say "we follow the applicable recommendations" with a totally straight face and no asterisk. We'll get there, and we'll keep this honest as we do.

If a federal warning about tank gauges made you stop and think about your own setup — good. That instinct is the right one. We're just glad we track tanks the boring, off-the-network way.