Uptime monitoring is configured

CWE-778 and OWASP A09 both identify the absence of monitoring as a prerequisite for undetected failures. Uptime monitoring is the most basic layer: without an external service probing your application on a 30–60 second interval, you learn your app is down from user complaints — typically 15–60 minutes after the outage began. For a SaaS, every minute of undetected downtime is lost revenue and accumulated churn risk. NIST AU-6 (Audit Review, Analysis, and Reporting) requires continuous monitoring of system activity; uptime monitoring is the minimum viable implementation of this requirement for a public-facing service. The 'never skip' status of this check reflects that no deployed application is exempt — static sites go down too.

Set up an external uptime monitor that probes your app's health endpoint every 30–60 seconds and alerts your team immediately on failure.

1. Create a health check endpoint first (see health-check-endpoint check) — GET /api/health returning { status: 'ok' } with HTTP 200.
2. Sign up for Better Stack Uptime (free tier: 10 monitors, 3-minute intervals) or UptimeRobot (free: 50 monitors, 5-minute intervals).
3. Add a monitor pointing to https://yourapp.com/api/health and configure alerts to email, Slack, or PagerDuty.

Document the setup in docs/operations.md:

## Uptime Monitoring
- Service: Better Stack Uptime
- Endpoint: /api/health
- Interval: 60s
- Alert channels: Slack #ops

If you're on Vercel, enable Vercel Monitoring in your project dashboard — it adds uptime checks with no additional configuration.