# Security and privacy

> What bay sends, where it sends it, and how you can check every claim yourself.

Source: https://getbay.io/docs/security (HTML).

bay runs on your machines, against your own Git remote. It has no server, no account and no telemetry. Your code goes only where your own Git remote is. bay is free and open source under the MIT licence, so you can read every line.

This makes bay fit for private repositories, in a company of any size. It does not replace your host's access control: anyone who can push to your remote can still push.

## What leaves your machine

| What | Where it goes | When |
|---|---|---|
| Changes, evidence, talks and fleet records | Your own Git remote, as commits, notes and refs | When a bay command fetches or pushes |
| A download of bay's release list and archive | GitHub, over HTTPS | `bay update`, and a background check at most once a day |
| What your adapters send | Where your adapter sends it | Only when your config names an adapter |

> The update check only downloads. It runs outside every repository and sends no repository data.
> Turn it off with `git config --global bay.updateAuto false`, or with `BAY_DISABLE_AUTOUPDATE=1`.

## Machines with no route out

bay needs no internet access. It needs only a Git remote that the machine can reach. With no network at all, move changes between machines with `bay share --bundle`. Turn off the update check there, and install bay from a release archive you verified.

## Checks run in a sandbox

On Linux, a check runs in `bwrap`. On macOS, it runs in `sandbox-exec`. The check sees only its candidate, its adapter and system files. It gets no network unless its `[[check]]` entry says `network = true`. bay reads that entry from trunk, so a change cannot grant itself the network.

> On a machine that runs checks with no sandbox, `bay doctor` is red with `SANDBOX_ABSENT`.
> When AppArmor stops `bwrap`, the red row names an AppArmor profile that fixes it.
> Its owner can choose to run checks without one: `git config --global bay.executorSandbox none`.

## Signed releases

A hardware-held key signs every release from 0.1.5. The install script and `bay update` verify the signature and the sha256 before they install. They refuse a release that does not verify, and the installed binary stays as it was.

## Read the code yourself

bay is one Rust program with five direct dependencies: `clap`, `serde`, `serde_json`, `sha2` and `toml`. It forbids unsafe Rust. Only `git` and `curl` reach the network: `git` to your remote, `curl` for bay's own releases. Every other program bay starts runs locally: `ssh-keygen`, `tar`, `sudo -n`, `id`, `hostname`, `kill`, `sh`, the sandbox and your agent CLI. Ask your coding agent to read the source and test each claim on this page.

```sh
git clone https://github.com/gudjon/bay.git
grep -rn 'Command::new' bay/src    # every program bay starts
grep -rn 'https://' bay/src        # every address bay reads
```

## Keys are optional

Without a key registry, bay runs unsigned, and every evidence record counts. Add a registry when only enrolled keys may sign. The Keys page shows how.

## Report a vulnerability

Report it privately: follow `SECURITY.md` in the bay repository, or email hello@getbay.io. Do not open a public issue.

## Limits

- On Windows, a check runs without a sandbox.
- The update check reaches GitHub at most once a day, and a download stops after 300 seconds.