Security

Last updated: November 13, 2026.

1. Reporting a vulnerability

If you think you have found a security vulnerability in Bilge, email support@bilge.sh with "Security report" in the subject. Please include the affected URL or component, steps to reproduce, what an attacker could do with it, and any proof-of-concept. Do not include other customers' data in your report.

We will acknowledge your report within 3 business days, keep you updated while we investigate, and tell you when it is fixed. With your permission we will credit you once the fix is live.

2. Scope

• The Bilge web app, dashboard and REST API at bilge.sh.
• The ingest endpoints (native, Sentry-compatible and OTLP).
• The SDKs and plugins we publish (bilgesh/tracing, bilgesh/cli, the WordPress plugin and the browser scripts).

Out of scope: denial-of-service or load testing, spam or social engineering, physical attacks, issues in third-party services we use (report those to the vendor), missing security headers or rate limits with no demonstrated impact, and reports produced only by automated scanners.

3. Testing rules

• Use only accounts and organizations you created; never access, change or delete data that is not yours.
• Stop and report as soon as you can access another customer's data, and do not keep it.
• Do not degrade the service for others: no high-volume or automated testing against production.
• Give us reasonable time to fix the issue before you disclose it publicly.

4. Safe harbor

If you follow this policy in good faith, we will not pursue legal action against you or ask law enforcement to investigate you for your research. We do not run a paid bug bounty.

Machine-readable contact: /.well-known/security.txt