rewindex

ChangesBitriseSecurity Incident

Bitrise: Incident updated: Security Incident

Incident updateNot classified yetChanged status.bitrise.io (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Discussed on Hacker News

Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.

Incident page: the full timeline of updates

What changed

Struck in red is what Bitrise removed; blue is what they added. Muted text is unchanged context.

AddedUpdateinvestigating#1
Before: not present
After: We are still making progress restoring the service, we expect the logins to app.bitrise.io to be restored soon, we are still working on a timeline for full restoration. We are actively working on bringing back all the build infrastructure as well online. The reason it takes long is because as an abundance of caution we shut down and rotated all our secrets used by the platform for signaling minutes after we saw an indication of live a attack on our internal system. It takes time to recover. We are working all hands on deck to get your service back up running. What we recommend As a precaution, once you are able to sign in, we recommend that you rotate all secrets, access tokens, and certificates stored in Bitrise. Services: All Services Scope: All Users Severity: SEV-1 When will the next update be available? You can expect a status update approximately 1 hour from now.
AddedUpdateinvestigating#2
Before: not present
After: We have brought app.bitrise.io back online in a limited safety mode. Expect most features to be still unavailable. You can sign in to review your workspace settings, connected Git accounts, secrets, certificates, and tokens, and rotate or revoke anything connected to Bitrise as a precaution. What we recommend As a precaution, once you are able to sign in, we recommend that you rotate all secrets, access tokens, and certificates stored in Bitrise. Services: All Services Scope: All Users Severity: SEV-1 When will the next update be available? You can expect a status update approximately 1 hour from now.

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.

How the archive is checked, and what it cannot prove.

Rewindex captured this after the last checkpoint; the next run () commits it.

History of this incident

TodaySaturday, November 14Sat, Nov 14

2 rewrites, 19 incident changes

YesterdayFriday, November 13Fri, Nov 13

3 incident changes

Cite this

Incident updated: Security Incident on Bitrise’s status page, changed 2026-11-14 20:43 UTC (change 21 of 24).

Title
Incident updated: Security Incident
Vendor
Bitrise
Date
URL
https://rewindex.com/change/r835cd523179ad7

All Bitrise changesBitrise profileMarkdownJSON