Bitlab is a fast-moving pre-1.0 project. Security fixes land on main and ship in
the next release; only the latest release is supported.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Anything older | ❌ |
Do not open a public issue.
Report privately through GitHub: Report a vulnerability. This opens a draft security advisory visible only to you and the maintainers.
Useful details to include:
- affected version and platform, and whether it reproduces in Desktop, WebUI, or CLI
- reproduction steps or a proof of concept
- what an attacker gains — code execution, credential disclosure, sandbox escape, or data exfiltration from the local workspace
You can expect an acknowledgment within 7 days and a status update within 30 days. Please give us a reasonable window to ship a fix before public disclosure. Credit in the release notes is offered unless you prefer to stay anonymous.
Bitlab runs an AI agent with tool access on the user's own machine, so a few behaviors that look alarming are working as designed:
- The agent can execute commands and edit files. That is the product. Permission modes (Explore, Ask, Execute) are the control surface; a report that Execute mode runs commands is not a vulnerability, but a way to bypass Ask mode is.
- The headless server binds locally and is guarded by
BITLAB_SERVER_TOKEN. Exposing it to a network without a strong token is a deployment mistake. A way to reach it without the token is a vulnerability. - Credentials are stored through the operating system credential manager. Any path that writes them to plaintext on disk or leaks them into logs, telemetry, or a model request is in scope.
Also in scope: prompt injection that escalates into tool execution the user did not approve, sandbox escapes from the document-tool subprocesses, the Browser pane reaching Electron main-process APIs, and update-channel tampering.
Out of scope: vulnerabilities in third-party model providers, findings that require an already-compromised machine or physical access, and reports generated by automated scanners without a demonstrated impact on Bitlab.
Releases may be published without signing certificates. Each release states its
trust status in the notes and in SIGNING_STATUS.txt, and every asset is covered by
SHA256SUMS. Verify downloads before running them:
shasum -a 256 -c SHA256SUMS --ignore-missingAn unsigned installer is a known, documented state — not a vulnerability report. See docs/code-signing.md.