Companies/Bitrise/Incidents

Bitrise: Security Incident

Affected components: 👥 Account ManagementBazel Remote ExecutionBuild Cache⚙️ Builds - CI🥫 Cache - Bazel Remote Execution🥫 Cache - Build Cache🥫 Cache - Key Value Dependency Cache Service📲 CodePush📊 InsightsKey Value Dependency Cache Service📦 Release Management

Timeline of updates

1. investigating2026-11-13 20:44 UTC

   We are responding to a security incident affecting some of Bitrise’s internal secrets, detected within the last hour. As a precaution we have temporarily taken Bitrise offline. We have no confirmation that any customer data or source code was accessed and are investigating urgently. Out of an abundance of caution, we recommend rotating any Git and source-code access credentials connected to Bitrise. We will share updates as soon as we know more.
   Scope:
   All Users
   Severity:
   SEV 1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

2. investigating2026-11-13 21:45 UTC

   We are continuing to investigate the security incident causing Bitrise to be unavailable.
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

3. investigating2026-11-13 23:01 UTC

   We are continuing to investigate the security incident causing Bitrise to be unavailable.
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

4. investigating2026-11-14 00:03 UTC

   We are continuing to investigate the security incident causing Bitrise to be unavailable.
   If you need to reach out to us please e-mail us at support@bitrise.io
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

5. investigating2026-11-14 01:26 UTC

   What happened?
   On November 13, 2026 at 11:32 EST (16:32 UTC), we detected suspicious activity in one of our internal cloud environments. Our initial investigation confirmed unauthorized access to an internal system. This system does not store or process customer data.
   Following our incident response procedures, we immediately took all of our services offline as a precaution while we investigated.
   At this stage, we have found no evidence that customer data, secrets, or source code were exposed. We are working all hands on the deck to determine the full scope and to restore our services as soon as possible.
   What we recommend
   As a precaution, once our services are restored, we recommend that you rotate all secrets, access tokens, and certificates stored in Bitrise.
   What’s next
   Our teams are working on completing the investigation and to restore all services safely.
   We understand the impact this has on your work and appreciate your patience.
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

6. investigating2026-11-14 02:29 UTC

   After ongoing investigations we have still found no evidence that customer data, secrets, or source code were exposed. We are now beginning to restore services in a controlled, phased manner. We do not yet have an estimated time for full restoration.
   What we recommend
   As a precaution, once our services are restored, we recommend that you rotate all secrets, access tokens, and certificates stored in Bitrise.
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

7. investigating2026-11-14 03:36 UTC

   We are making progress restoring the service, we expect the logins to app.bitrise.io to be restored by 01:00 EST (06:00 UTC), we are still working on a timeline for full restoration.
   What we recommend
   As a precaution, once you are able to sign in, we recommend that you rotate all secrets, access tokens, and certificates stored in Bitrise.
   Services:
   All Services
   Scope:
   All Users
   Severity:
   SEV-1
   When will the next update be available?
   You can expect a status update approximately 1 hour from now.

Changes Rewindex caught on this incident

• Nov 13Critical incident: Security Incident
• Nov 13Incident updated: Security Incident
• Nov 13Incident updated: Security Incident
• Nov 14Incident updated: Security Incident
• Nov 14Incident updated: Security Incident
• Nov 14Incident updated: Security Incident
• Nov 14Incident updated: Security Incident

Impact, status and times are the vendor’s own, as last archived. View on status.bitrise.io (opens in new tab).

Bitrise profileRecent Bitrise incidentsAll outages on November 13, 2026Bitrise in November 2026MarkdownJSON