Snapshot 180694
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Bitrise Trust Center Welcome to our central hub for security, compliance, and privacy. Our Trust Center explains how we protect customer data, manage risk, and meet industry standards so teams can safely ship their apps with the Bitrise Mobile DevOps Platform. We recently migrated over to our new Trust Center. In case you experience any issues accessing our portal, please reach out to us. security@bitrise.io Privacy PolicyOpens in new tab AWS Marketplace listingOpens in new tab Filter by Please keep in mind that signing an NDA or having a valid Bitrise subscription is required to access the content of this page. Compliance SOC 2 GDPR PCI DSS 4.0.1 Resources View all Bitrise SOC 2 Type II – Final-Report (2026-2027) CAIQ (2026-2027) bitrise-network-diagram-2025-2026.pdf Bitrise_PCIDSS_AOC_2025-2026.pdf POL006 Incident Response Policy-020926-090617.pdf Bitrise Penetration Test Remediation Notes – 2025-2026.pdf SEC-POL005 - Data Handling Policy-020926-090427.pdf SEC-POL001 - Information Security Policy-020926-085957.pdf SEC-POL008 - SaaS Infrastructure Management Policy-020926-090650.pdf Controls View all Infrastructure security Production database access restricted Unique production database authentication enforced Unique network system authentication enforced View 4 more Infrastructure security controls Organizational security MDM system utilized Anti-malware technology utilized Employee background checks performed View 3 more Organizational security controls Internal security procedures Board oversight briefings conducted Board charter documented Board expertise developed View 15 more Internal security procedures controls Data and privacy Data classification policy established Data retention procedures established Product security Control self-assessments conducted Penetration testing performed Updates View all Security Not impacted: Compromised eMudhra intermediate certificates Published October 22, 2026 What happened? On October 20, 2026, Mozilla and Google’s Chrome Root Program confirmed that the private keys of eight eMudhra intermediate certificate authority (CA) certificates had been compromised. With these keys, someone could issue fraudulent TLS certificates that systems relying on the affected CAs would treat as trusted. Browser and operating system vendors are now blocking the affected certificates. What measures Bitrise is taking? We are updating our systems to remove trust in the compromised eMudhra intermediate certificates, and we’re doing it in a way that keeps service running for our customers. We have no evidence that this issue affected Bitrise, our services, or our customers’ data in any way. Our Security team keeps watching this issue and our third-party vendors. If anything changes, we’ll update this notice. See our blog post about the matter: https://bitrise.io/blog/post/emudhra-certificate-compromise-bitriseOpens in new tab Security Not impacted: CVE-2026-109618, CVE-2026-109619 (PHP2Shell) Published October 21, 2026 What happened? Recently, critical remote code execution vulnerabilities known as “PHP2Shell” were discovered. The PHP Project fixed this in an out-of-cycle security release on October 21, 2026. As we are not not using any PHP in our production components, Bitrise is unaffected by this vulnerability. What measures Bitrise is taking? The Bitrise platform and its services are not affected. None of our products, services, or customer-facing infrastructure are built on or run PHP, so no action is needed from Bitrise customers. Our Security team keeps watching this issue and our third-party vendors. If anything changes, we’ll update this notice. General CVE-2026-43760: macOS screensharingd vulnerability Published September 30, 2026 What happened? On 27 July, 2026 CVE-2026-43760 vulnerability discovered, affecting macOS operating system’s screensharingd daemon. This vulnerability represents a critical access control weakness that could potentially allow malicious applications to bypass intended security boundaries and access sensitive user data through the Screen Sharing VNC feature. On 30 July, 2026 as a preventive action to protect customer data, Bitrise disabled internet-facing access to VNC. SSH access is unaffected and remains fully available. The vulnerability impacted only the RDE and rebuild with remote access workloads. Was this vulnerability exposed? After a careful review of our systems, logs, and available data, we found no evidence that this vulnerability was exploited to access any of our systems or build machines. Despite our ongoing efforts to identify potential exposures, this macOS vulnerability was discovered only recently, though it may have existed in macOS for an unknown period. As a best practice, we advise rotating keys and secrets for any customer who used screen sharing capabilities in their builds. This feature is off by default. Customers need to take action to turn it on, and it is only running a couple of minutes. When and how this vulnerability will be fixed? This issue is only affecting macOS operating systems and it is now fixed in macOS Sonoma 14.8.8, and macOS Tahoe 26.6. Bitrise is currently working on updating macOS on all machines. Once the updated is delivered, we’ll check & monitor this vulnerability before enabling internet-facing VNC on macOS machines. Customers who need VNC access can use SSH tunneling to reach it securely by forwarding the VNC port through an SSH connection (e.g., ssh user@NGROK_SSH_ADDRESS -p NGROK_SSH_PORT -L 5900:localhost:5900Opens in new tab) and then connect to 'localhost:5900Opens in new tab' with a VNC client. What other measures Bitrise is taking? At Bitrise, mitigating security threats is a top priority. We follow industry best practices to minimize risk, and we've taken the following actions to protect customers from attacks exploiting this vulnerability: - We disabled access VNC on all macOS machines. - We updated our firewall on the physical hosts. - We are testing the latest macOS release addressing this vulnerability. - We will soon update all physical machines to macOS Tahoe 26.6. - We will monitor this vulnerability before enabling VNC on macOS machines. More information: https://support.apple.com/en-us/128067Opens in new tab https://support.apple.com/en-us/128072Opens in new tab https://cve.akaoma.com/cve-2026-43760Opens in new tab This update was originally posted on 4 August, 2026. General Not Impacted: Copy Fail, Dirty Frag, and Fragnesia Published September 30, 2026 The recent run of Linux kernel local privilege escalation bugs has prompted a fair number of "are we exposed?" questions from customers, so here's the short version: your builds on Bitrise are not at risk from these CVEs. Each build runs in its own dedicated, ephemeral VM on our stacks, spun up when your workflow starts and destroyed the moment it ends. Nothing from one customer's build ever touches another's. Every customer already has root inside their own build VM by design (it's your environment to do what you need with), so a local privilege escalation bug gains an attacker nothing they didn't already have. The boundary between your VM and our infrastructure that actually matters is enforced at the hypervisor, not the guest kernel, and kernel LPEs don't cross that line. We still patch our base images on a regular cadence as a matter of hygiene, but there's no urgent exposure here and no action needed on your side. This update was originally posted on 14 May, 2026.