Security & disclosure

We ask customers for access to production servers, so our access model is public. This page states exactly what we run, what data leaves your server, and how long anything is kept.

How we work on your server

Read-only first. The external scan uses passive fingerprinting plus limited, read-only checks of a few well-known paths (for example, an exposed phpinfo page) — all of what your site already discloses publicly. We never run exploit probes against a site, and site operators can opt out of scans at any time (see the Terms).
Ownership before access. Before any server check, we verify you own or administer the site (a DNS record or a small file you place).
The deep check only reads. It inventories PHP binaries, per-SAPI versions, packages and containers, and scans recent logs for crash indicators. It changes nothing and installs nothing.
A plan you approve. You see the exact patch plan before anything is applied. No approval, no change.
A safety net that is tested first. Before a patch, we snapshot the runtime and restore-test the snapshot. If the snapshot cannot be proven good, the patch does not run.
Reversible by construction. The patched build is verified before it takes traffic. If post-patch checks fail, the change reverts automatically, free, on every paid tier. One-click rollback restores the exact pre-patch state, verified against the pre-patch baseline.

What data we hold, and for how long

Scan and check results, the patch manifest, and the work report are stored on our side so we can hand you the report and support the engagement.
Pre-patch snapshots are retained 72 hours on the Patch tier and for an extended window on Patch + Rollback, then deleted. Ask us at any time and we delete your snapshot and engagement data early.
We never touch your database during runtime patching, and we never sell engagement data.

Open-source scanner

The free scanner is open source (MIT): github.com/PHPatch/phpatchscan — the exact code that runs the scan on this site, including its SSRF test suite. The patching engine is not open source.

How we access your server

Keys are never stored. For a deep check or a patch you grant access for the job — an SSH key or a temporary account you create for us. It is used only during the engagement; we do not persist customer private keys in our systems.
Host keys verified. Access runs over SSH with host-key verification. If a server's host key changes unexpectedly, we stop and contact you before proceeding.
Read-only first. The deep check runs read-only commands only. Patching is a separate, later step that runs under the tested snapshot described above.
Audited. The commands run and the changes made are recorded in the job manifest and in the work report we hand you.

Reporting a vulnerability in our service

If you find a security issue in phpatch.com or in our tooling, please report it through this page's contact channel (the canonical contact is in our security.txt). We aim to acknowledge reports within two business days. Good-faith research that follows this policy — no data destruction, no privacy violations, no service disruption — is welcome and will not be met with legal action from us.

Superstar Telecom LLC · phpatch.com · Free scan
Not affiliated with the PHP Group. PHP is a trademark of the PHP Group.