Thank you in advance for helping us keep devbox secure!

Please report any security issues or vulnerabilities to security@rudderstack.com, before proceeding to post them publicly as issues on GitHub or any other public channel. These issues might also affect other users, and security vulnerabilities need to be handled quickly and sometimes privately.

We will triage the issue, contact you for further instructions and make sure to take any necessary measures as needed.

The security model devbox aims for is described in the README. A way for the agent in a sandbox to read a real credential, or to push to a GitHub repo that is not in devbox.config.json, is a security issue.

devbox has no releases yet. We fix security bugs on the main branch only.