What leaves a site

Without a Porro account, nothing about the site is sent anywhere: the panel's checks look up public data, and activity stays on the site.

Once connected, a connector sends one signed report on a schedule (PHP) or per build (JavaScript). Run porro:status --json (porro/status --json on Craft, --dry-run for JavaScript) to see the exact report.

In a report

• Versions: PHP and the framework (Laravel, Statamic, Filament, Craft), and package names and versions from the lock file. The package list is only sent when the lock file changes.
• The environment's name, and whether debug or dev mode is on, as true or false, never the value of any setting.
• Health facts: the scheduler or cron heartbeat, failed jobs in the last 24 hours, pending migrations and the queue.
• Failed jobs: the job's name, the exception class and where it was thrown, how many and when. Not the job's data or the message. PORRO_FAILED_JOB_MESSAGES=true adds each message's first line, cut to 160 characters, with email addresses, file paths and long numbers replaced.
• The database: its engine and version, whether it's on the same server, and the provider if it's a known managed database. Never its host, name, user or password.
• Backups and health checks, from spatie/laravel-backup and spatie/laravel-health if installed.
• The server: the operating system's name and version, the kernel, whether a reboot is waiting, and a hashed machine ID, so sites on one server are grouped as one server.
• The server's packages (Ubuntu and Debian): installed package names, versions and sources, and whether unattended upgrades are on and when they last ran, so Porro only raises the Ubuntu and Debian security notices that apply. The full list is only sent when Porro asks for it; otherwise just a hash of it.

Never

Content, entries, customer or user data, environment values or secrets.

How reports are signed

Each report is signed with Ed25519 using the site key. The key's private half stays on the site; Porro stores only the public half. A signature covers the method, the path, a timestamp, a one-time nonce and the body, so Porro rejects anything unsigned, altered, more than five minutes old or replayed. The site only ever sends: Porro never connects in and never sends commands. Reading the site's findings back is a GET from the site, signed with the same key.

Outside services