What PHPFixes can access
PHPFixes helps server owners assess their PHP software. Its runner is a Python program that you install on a server you control. This page explains what the Scan runner reads, what it sends to PHPFixes and how to revoke its permission.
Paid services are still closed. These details describe the prepared Scan software. Live sign-in, payment and delivery must pass final checks before public purchases open.
What runs on your server
You download the runner, check its SHA-256 checksum against the value shown during setup, and start it yourself. A checksum confirms that your download matches that published file. The runner connects outward using encrypted HTTPS connections. You do not submit an SSH password or private key to this website.
Current supported setups require root, the Linux administrator account. Scan is designed to inspect software and write its own private setup records and report. Its normal flow does not install PHP patches or repair application files. It calls installed PHP and system tools to collect information.
Administrator permissions are broad. The runner does not create an operating-system sandbox to restrict what its process can access. Software already present on a compromised server can interfere with collection or have side effects. Connect only a server you have authority to inspect.
What Scan reads and uploads
The support check reads operating-system, Python and PHP details before checkout. The paid Scan reads versions of PHP and its installed packages, relevant settings, details of running programs and selected local files and logs. Collection has limits on time and the amount of evidence read. It does not inventory other servers or containers.
The support check sends platform and PHP details, runner and engine versions, software checksums, an installation identifier and a hash of the local machine ID. The raw machine ID is not sent.
The paid report accepts these fields:
- Operating system, processor type, software installer, hosting control panel and whether the runner has root access or is in a container.
- Installed PHP programs and packages, including versions, executable paths and whether any PHP processes still use an older loaded version.
- Security findings, the reasons for each finding, confidence, exposure and any fixed-version target.
- Required-check results, brief findings and recommendations, relevant file paths and short collection errors.
- Tool version, completion status and flags describing which collection methods were used.
Raw configuration, environment variables, command output and log contents are excluded from the uploaded report format. File paths and short descriptions can still reveal private information. Review a downloaded report before sharing it.
Your account and payment
The prepared customer flow uses Firebase sign-in with a verified email. Private API requests check that the account owns the setup, order or job. An order reference or payment-session link does not grant access to a private report.
Card entry happens on Stripe's hosted checkout page. PHPFixes stores order and payment references, not your full card number. The website confirms price and device eligibility before creating checkout.
Setup, order and report records are stored in the service backend. The runner also keeps private records on your server. Current software does not apply a fixed automatic deletion schedule to those records. See our Privacy Policy for information requests and storage practices.
Permission, expiry and stopping a Scan
The first enrollment token can register one device and expires after ten minutes. Later permission is tied to that setup and device identity. Keep tokens private and paste them only into the runner's hidden prompt.
- A support-check credential lasts up to 24 hours and can only report that check or activate its paid Scan.
- A Scan credential lasts up to one hour and belongs to one job.
- The runner sets a two-minute limit for the support check and a ten-minute limit for normal Scan collection. These timers do not contain hostile software already running with administrator access.
The Scan runner accepts a fixed read-only assessment task. It does not provide an interactive remote shell. Device matching helps prevent accidental reuse of setup files on another server. An administrator who controls the machine can forge its reported identity or results.
To revoke access, open your setup or Scan in your customer account and choose Cancel setup or Cancel scan and revoke access. This blocks further authorized work and new report submissions. Normal collection already running may continue until its configured deadline. Closing the terminal or signing out does not guarantee an immediate stop. Keep its private records if you need the report or help with an interrupted run.
Assessment limits and planned changes
A Scan reports the software and evidence it inspected. It cannot establish that a server has never been compromised. Required evidence that cannot be collected produces an incomplete result. Only tested server setups can proceed to checkout; supported environments appear on the connection screen.
Automatic Patch and Care work are not open. Proposed Patch safeguards include an approved change plan, a maintenance window, a usable backup or snapshot, application checks and a recovery method. These remain release requirements, not a promise that the current Scan can repair a server or restore it after a failed update.
Report a security concern
PHPFixes is owned and operated by SnowRock, LLC. Send security reports to [email protected]. Include the affected page or software version, what happened and steps to reproduce it using accounts and systems you control. Leave out passwords, private keys, enrollment tokens and other customers' information.
For payment or service questions, use [email protected]. Our security reporting address is also published in security.txt.