Skip to content
Patrol

Security

How your events travel and where they stop

Patrol is two things with different exposure: a library that runs inside your process, and a hosted service that receives what it sends. This page covers both, in the order an event meets them.

In your process

The library opens no listening socket and starts one goroutine. It reads no file, writes no file and sends nothing anywhere you did not configure. A producer with a Slack flusher talks to Slack; a producer with a SQL flusher talks to your database. There is no telemetry, no update check and no phone home, and the source is onGitHub under BSD-3-Clause for anyone who wants to confirm that.

What lands in an event is what your code puts there. Fields, attached files and mentions are your data, and a stacktrace carries file paths and line numbers from the machine that built the binary. Treat an event the way you treat a log line: nothing stops you putting a password in one.

On the way to Patrol Cloud

  • TLS. Ingest is https://api.patrol.hellenic.dev, HTTPS only. The library does not check the scheme for you, so paste the BaseURL the console shows and leave it alone.
  • One credential per project. A key is a public id and a secret shown once. Send it as a bearer token (Authorization: Bearer key.secret) or as HTTP Basic with the id as the username. The secret is stored as a SHA-256 hash and compared in constant time, so nobody, us included, can read it back. Revoking a key takes effect within a minute.
  • A cap on the body. Anything over 32 MiB is refused with 413 and PAYLOAD_TOO_LARGE before it is parsed, and your plan may set a smaller one. That is a denial-of-service boundary as much as a batching hint.
  • No cookies on the ingest path. Ingest takes a key and nothing else. The console is a separate host with its own session, and its refresh cookie is HttpOnly, Secure and scoped to the auth path.

What Patrol Cloud stores

The event as you sent it: type, project name, message, the three timestamps, your fields, attached files, mentions and the stacktrace. Around it we keep the account, the projects, the ingest keys (hashed), the destinations you configured and a record of the deliveries that failed. Credentials you give a destination, a Slack token or a Twilio auth token, are encrypted at rest with AES-256-GCM and are never returned by the API, not even to you.

Events are deleted when their retention window passes: Free 7 days, Pro 30 days, Business 90 days. Deletion drops the storage partition rather than setting a flag, so an expired event is gone and not hidden.

Reporting a vulnerability

Email contact@hellenic.dev with what you found and how to reproduce it. Please do not open a public issue for a security bug in the hosted service. We answer within three working days, say what we intend to do about it, and credit you in the changelog unless you would rather we did not.

A bug in the library that is not a security problem belongs inGitHub issues, where everyone can see it and help.