Security
Report a leak in the hull
Benbow runs with your permissions, creates a local certificate authority and can install a small helper. Reports about any of it are taken seriously.
Reporting a vulnerability
Please don't open a public issue. Report privately instead:
- by email to hello@benbow.dev, with a subject starting with
[security], or - through GitHub's private vulnerability reporting, in the Security tab of
benbowdev/benbow.
Include what you found, how to reproduce it, the Benbow version (benbow version) and your macOS version. Not sure it's a vulnerability? Report it anyway.
What to expect
- An acknowledgement within 3 working days.
- An assessment and, if confirmed, a plan for a fix within 14 days.
- Credit in the release notes once the fix ships, unless you'd rather stay anonymous.
Benbow is maintained by one person, so please allow some flexibility, and give a reasonable time to ship a fix before disclosing. We'll agree on a date together. Only the latest release receives security fixes.
Scope
The benbow CLI and core, the macOS app, the privileged helper, the certificate authority and its name constraints, the binaries Benbow downloads and verifies (including those built in benbowdev/benbow-binaries), the MCP server and the local API socket. Problems in PHP, Caddy, MySQL, PostgreSQL, Redis, Mailpit, Xdebug or Adminer belong upstream; tell us too if Benbow ships an affected version.
How Benbow is built to be safe
- The core runs as you, never as root. The optional helper only edits Benbow's own block in
/etc/hostsand its own port forwarding rules. - The certificate authority can only sign
.localhost,.testand.localnames, so a stolen copy can't impersonate a real website. - Every binary is checked against a pinned SHA-256 before it runs, and component updates come from a manifest signed with a key that only exists in CI.
- Services listen on 127.0.0.1 only. Sharing a site with your phone is opt-in, one site at a time, and turns itself off.
- Passwords live in the macOS keychain, never in files, URLs or command lines.
- AI agents are read-only until you allow changes, and can never delete sites, databases or snapshots or push to a server.
The full policy is in SECURITY.md.