Security

Last updated: September 17, 2026

Bugmole tests your applications, so it handles sensitive things: access to your environments, your source code, and evidence of how your app behaves. This page explains how we protect them and how to report a problem.

Your evidence stays with you by default

Bugmole's project worker runs on your machine or your CI. With the default local storage, screenshots, recordings, and logs are written to a folder on that machine and are never uploaded to us. The dashboard reads them directly from your machine over a loopback-only connection (127.0.0.1) that:

• requires a random, short-lived access token, which expires after 30 minutes;
• only answers requests from the Bugmole dashboard's origin;
• only serves files that belong to the project it was started for.

If you prefer cloud storage, evidence goes to a bucket in your own cloud account, and you control access to it.

Accounts and access

• Sign-in uses The AI Inc. identity service with OAuth 2.0, PKCE, and signed ID tokens that are verified on every sign-in.
• Sessions are stored in encrypted, HTTP-only, secure cookies that expire within hours.
• API keys are shown to you once and stored only as SHA-256 hashes. Each key can be limited to specific projects, permissions, and an expiry date, and can be revoked at any time.
• CLI pairing uses short-lived codes that expire after five minutes, are stored as hashes, and are rate-limited.
• Project access is checked on every request: you only see workspaces and projects you are a member of, and stored evidence is scoped to its project.
• Secrets are compared in constant time to resist timing attacks.

Infrastructure

• Bugmole's hosted components run on Cloudflare's global network.
• All traffic to this website, the dashboard, and the registry is encrypted with HTTPS.
• Server credentials are kept in encrypted secret storage, never in source code.
• Cloud storage credentials you configure are read from environment variables on your machine and are not sent to us.
• This website sends a strict Content Security Policy and other security headers, sets no cookies, and runs no third-party analytics.

Integrations

• GitHub: the Bugmole GitHub App asks only for the access it needs to search, read, and create issues. Every webhook is verified with an HMAC-SHA256 signature before it is processed, and GitHub access tokens are short-lived and scoped to your installation.
• AI providers: planning and analysis call the AI provider you choose from your own environment, with your own credentials.
• Temporary inboxes created for sign-up tests are disposable and deleted after each run.

Safe testing practices

Bugmole is built to test pre-production environments. We recommend that you:

• use dedicated test accounts and test data;
• keep production credentials out of test flows;
• give API keys only the projects and permissions they need, with an expiry date;
• remove a project's run history with Reset project, and its local evidence with bugmole reset, when you no longer need them.

Reporting a vulnerability

If you believe you have found a security issue in Bugmole, please email info@theaiinc.com with the details and steps to reproduce. We will acknowledge your report, keep you informed while we investigate, and credit you if you wish once it is fixed.

Please act in good faith: only test against your own accounts and projects, avoid accessing or changing other people's data, do not degrade the service, and give us reasonable time to fix the issue before sharing it publicly. We will not pursue action against research that follows these guidelines.