Security

Security lead

Shuttle is built by Atomic BI Pte. Ltd. (Singapore). Security is owned by Tobias Strebitzer, Founder & Security Lead and the project's lead maintainer. He is the accountable contact for vulnerability reports and security incidents: tobias.strebitzer@atomic.bi.

Reporting a vulnerability

Report privately through GitHub: Report a vulnerability (Security tab → "Report a vulnerability"), or email the address above. Don't open a public issue. Include the Shuttle version (chrome://version), your OS, steps to reproduce and the impact. We acknowledge reports within 3 business days and aim to fix confirmed high-severity issues within 30 days. There is no paid bug bounty.

Scope

• Shuttle's own code: the MCP server and agent/session model (chrome/browser/shuttle/), per-session CDP endpoints, chrome://agents, the bundled agent-browser integration, and the build and release scripts.
• Chromium vulnerabilities that also affect Google Chrome go to the Chromium security team. Tell us too if Shuttle is affected differently.

Updates and Chromium tracking

Shuttle follows Chromium stable security releases (currently Chromium 155.0.8059.80). Each upstream release is triaged, merged and rebuilt, and the fixes are verified on the surfaces Shuttle adds: per-agent storage partitions, session-scoped tab groups, and the local MCP/CDP control plane. Only the latest release receives fixes; there is no auto-update yet, so watch Releases.

Threat model

• The CDP/MCP port (default 9222) listens on 127.0.0.1 and has no authentication: any local process can drive the browser, as with Chrome's --remote-debugging-port. Web pages can't reach it: requests with a foreign Origin or a non-local Host header are rejected.
• A per-session CDP endpoint only sees that session's tabs and its agent's storage. It is a boundary between cooperating agents, not a sandbox against hostile local code.
• Agents act on untrusted web content. Prompt injection that drives an agent to misuse its own session is a property of the agent, not of the browser; what Shuttle guarantees is that one agent's session can't read or act in another's.

Safe harbor

We won't pursue legal action against researchers acting in good faith: test only your own installs and accounts, don't access or damage other people's data, and give us reasonable time to fix an issue before disclosing it. Unsure whether something is in scope? Ask first.

The canonical policy also lives in SECURITY.md in the repository.