Use PortPilot / SOURCE v3.5.7
Controls & boundaries
What an observation means, which controls change real state, and where PortPilot’s authority ends.
Observe with context#
PortPilot inventories local OS state and highlights behavioral signals. Detection is heuristic, and visibility depends on user permissions and snapshot completeness. No findings does not establish that a machine is safe.
Failed or incomplete reads are shown as degraded or stale, retain the last successful observation when available, and do not advance the learning baseline. They are not converted into a successful empty snapshot.
An alert list annotates observations. It is not a firewall, and adding an entry does not block network traffic. PortPilot is not endpoint protection or a malware scanner; keep existing firewall and endpoint protections enabled.
Act deliberately#
Kill, pause, resume, Docker control and Guard affect running processes. Guard can terminate later holders of an armed port, including while threat monitoring is paused. Review active guards separately from monitoring.
Before a cached process action, PortPilot rechecks the PID and captured process-start identity; changed or missing identity refuses the effect, and only a confirmed receipt justifies “stopped.” A final user-space validation-to-signal race still remains.
PortPilot operates with the logged-in user’s authority. Run monitoring and control commands as your normal user; do not elevate runtime privileges to improve visibility.
Two different proxies#
The app’s Quick Proxy is a raw TCP listener, loopback by default. Enabling source CIDRs makes it listen across interfaces; those CIDRs are not authentication, encryption, or proof that traffic arrived through a physical LAN interface.
IPv4 and IPv6 /0 policies are rejected, but another broad range can still be dangerous. Prefer exact /32 or /128 client entries, keep target-service authentication and TLS, and do not add router forwarding casually.
The CLI’s proxy command uses OpenSSH for a SOCKS tunnel. It has different controls. Read portpilot proxy --help before using it.
Scheduled commands are executable code#
The app’s Run Now action deliberately runs a cron command through /bin/sh -c as the user. It is not sandboxed. Review commands before running them, and treat captured output as potentially private.
Incomplete discovery retains an inspect-only last-good list and disables Run Now and editing. A manual run is capped at 256 KiB of captured output and one hour. Stopping descendants is best-effort; detached work and independently scheduled OS cron runs can continue.
Release integrity is a separate gate#
Release policy requires audited main, a verified signed commit and annotated tag, Developer ID signing, hardened runtime on every architecture, and no known exception entitlements.
Source and build checks do not prove that an artifact is notarized, published, installed, or live-validated. Read the Daybreak audit ↗ for findings and verification limits, and mission.md ↗ for the product boundary.