site_key_mutator

Site Key Mutator will anonymize the deployment unique site key transferred by the Drupal Core Update module.

It is still possible that third parties could correlate requests to fingerprint a site. This module only disables/randomizes the tracking ID's sent in request.

Features

Anonymizes the site id for each new request by either:

• Removing the site id
• Replacing with a random site id

Why?

Site owners have seen from the 2024 WP Engine Tracker incident that update API's can reveal information site owners would otherwise desire to keep private

The presence of a unique per deployment/per site(domain) identifier in the update module allows for Drupal.org and other actors to profile site owners.

While the Drupal Update API is currently not as invasive as some other CMS API's are (Down The Rabbit Hole - A Look At The WordPress Update API) it still allows gathering unique information about site owners.

This module provides what should already be a core feature, to separate the telemetry tracking from the functional aspect of reporting update status.