The BranchBase team and community take the security and integrity of developer environments seriously.
Security fixes are applied to the active development branch (main) and released as patch versions.
If you discover a security vulnerability or sensitive data leak in BranchBase, please do not disclose it publicly in issues, discussions, or social media.
Please submit a report privately through: GitHub Private Vulnerability Reporting
Alternatively, contact the lead maintainer directly at:
omaderabolano@correo.unicordoba.edu.co
To help us triage and resolve the issue quickly, please include:
- A clear description of the vulnerability and its potential impact.
- Detailed step-by-step reproduction steps or a minimal proof of concept (PoC).
- Affected components (e.g., Transparent Proxy, Git Resolver, PostgreSQL Driver).
- Any proposed remediation or fix, if available.
- Initial Acknowledgment: Within 48 hours.
- Assessment & Triage: Within 5 business days, including a severity score (CVSS).
- Remediation & Patch: Coordinated disclosure with the reporter once a verified patch is ready.
- Localhost Isolation: The BranchBase TCP proxy binds to
127.0.0.1by default. Setproxy.listen_hostdeliberately to expose it on another interface. Startup packets have a deadline and concurrent connections are capped. - Non-Destructive Operations: The configured default Git branch maps to the base database (including custom branch names), and the driver refuses to delete that database.
- No Product Telemetry: BranchBase does not send telemetry, metrics, or proxy query logs to an external service. If a team configures an external Risk Gate provider (such as Jev/OpenRouter), migration SQL and schema context may be sent to that provider for classification; offline mode avoids those requests. Proxy routing is decided locally from the active Git branch.
We welcome security researchers acting in good faith. Please avoid accessing, modifying, or deleting data that does not belong to you, disrupting services, or degrading other users' experience.