Security

Porchlight holds a list of older people's email addresses and the breaches they appear in. That is a useful list to the exact people we exist to protect against, so the design assumes we will one day get something wrong and tries to limit what that costs.

This page describes what is actually built, not what is planned. Where something is not done yet, it says so.

The job that checks cannot read what it has no right to

The weekly breach check runs under a database account that can only read addresses whose owner has confirmed. It has no access to the rest — not to unconfirmed addresses, not to the consent links, not to sign-in data. A future mistake in that job cannot reach an address nobody agreed to, because the database refuses, and our test suite checks that refusal against the real account.

Links are stored as one-way hashes

The confirm and stop links we email are kept only as SHA-256 hashes. Someone reading our database cannot reconstruct a working link.

Consent decisions are written down and cannot be edited

Every consent decision — an address added, a message sent, an agreement, a refusal, a stop — is written to an append-only log in the same operation that makes the change, so the record cannot end up disagreeing with reality. The database rejects updates and deletes on that log. Addresses in it are masked.

Your browser does not announce what we found

Breach logos are served from our own domain. Loading them from the breach database directly would make your browser tell a third party, and your network, exactly which breach is on your screen.

What we do not hold

• No card numbers. Payment goes directly to Stripe.
• No passwords for any account other than Porchlight itself.
• No bank or credit data. We do not connect to financial accounts.
• No details of sensitive breaches where no one is entitled to see them — only a one-way hash so we know not to look again.

What is not done yet

Database row-level security policies are written and tested, but the application still connects with an account that bypasses them, so today the enforcement that matters is in the application layer rather than the database. We would rather say that plainly than imply a protection we are not yet relying on.

Reporting something

If you find a security problem, please write to security@porchlightsecurity.org. We will not pursue anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

Last updated 16 September 2026.