Button security
What a Button form can and can't do on your computer
Button turns a script on your computer into a web form that invited colleagues can run. The job runs on your machine, one run at a time, for up to 30 minutes. Our servers pass form values and files between the browser and your computer; uploaded files are deleted 24 hours after a run ends and results after 7 days.
Only the command you approved runs
You set up a tool in the runner's setup page on your own computer. That's where you pick the program (a Python, Node, R, PowerShell or shell script, or a compiled binary) and describe its inputs. The setup page opens through a one-time link on your computer itself (127.0.0.1) and closes after you publish or after 15 idle minutes.
When you approve a tool, the runner stores the exact command and the form, pinned by a hash. For that tool it will start that command and nothing else. A colleague fills in the fields you defined, but can't change the program, its fixed arguments or the folder it runs in.
The hash covers the command and the form, not the contents of your script file. If you edit the script's code, the next run uses the new code without a new approval, so treat the script file as part of the tool.
Values are arguments, not code
Inputs can be text, numbers, yes/no, a choice from a list, or a file; each file field takes one file. When a colleague presses Run, the runner passes each value to your program as its own argument. A file arrives as the path to a copy in a fresh folder for that run.
There's no shell in between, so a value like ; rm -rf ~ reaches your program as plain text and is never executed by Button. Values that start with - are refused, so nobody can slip an extra flag into your command; it also means a number field can't take a negative number. What your program does with a value is up to your code: if your script hands it to a shell itself, that protection ends there.
Changed tools need a new approval
If you change a tool's command or form, it gets a new hash, so it has to be approved again on your computer before the runner will start it. The people you invited see that the tool changed and confirm the new version before they can run it again.
Who can run a tool
Only people you invite can open a tool page. You invite colleagues by email; they open the link and sign in with Google or a one-time email code, using the address the invite went to. They don't install anything and never pay.
You can revoke someone's access at any time or give it an end date, and you can revoke invites that haven't been accepted yet. Each colleague sees only their own runs; you see every run of your tools.
Every run is recorded
Each run is recorded with who started it, when, and how it ended, and you can see that history in the app. Access changes, such as invites, accepted invites and revocations, also go into an audit log, which is kept for 30 days.
Limits on every run
- One run at a time per computer. Nothing is queued: a run started while your computer is Busy or Offline is turned away.
- 30 minutes per run. A run that takes longer is stopped.
- Up to 8 files per run, 25 MB per file and 100 MB in total.
- A log of up to 1 MB per run, only when the tool keeps one.
A colleague can cancel a run they started, and the runner stops the program. Closing the browser tab doesn't cancel a run.
What passes through our servers
Your script runs on your computer, not on ours. The form values and files do pass through our servers on the way between the browser and the runner, and the result files your program writes come back the same way. Private means access-controlled: only you and the people you invite can see a tool and its runs, but the data isn't hidden from us.
| What | How long we keep it |
|---|---|
| Uploaded input files | Deleted 24 hours after the run ends |
| Result files and run logs | Deleted 7 days after the run |
| Uploads that never became part of a run | Deleted after 1 hour |
| Typed form values and the run record (who, when, result) | Kept with your run history |
| Access audit log | 30 days |
| Your account, tools and invites | Until you ask us to delete your account |
The runner connects out to Button over an encrypted WebSocket and doesn't open a port to the internet on your computer. Pairing codes work once, and we store the runner's credential only as a hash. Sign-in codes and sessions are stored as hashes too.
What Button doesn't do
Button doesn't sandbox your program. It runs under your user account, with the same access to files, folders and credentials that it has when you run it yourself. Publish programs that are safe to run with any value an invited colleague can type into the form, and invite people you'd trust to run them.
Button also can't run anything while your computer is off, asleep or offline. Tool pages show the current state: Ready, Busy or Offline.
For the full list of what we store and who processes it, see the privacy policy.
Reporting a security issue
Found a security issue in Button? Email abuse@bitgate.com with what you found and how to reproduce it.
FAQ
Where does the code run, and with what permissions?
On the creator's computer, never on our servers. There is no sandbox: the program runs under the creator's user account with the same permissions they have when they run it themselves. The runner only starts the command the creator approved on that computer, pinned by a hash.
How does Button stop command injection through form fields?
Every value is passed to the program as its own argument, without a shell, so shell syntax in a field is just text. Values can't start with a dash, which stops anyone from adding flags to the command.
Can a colleague change what my tool runs?
No. Colleagues only fill in the fields you defined. The program, its fixed arguments and the folder it runs in come from the tool you approved on your computer, and changing the command or the form needs your approval again.
What can Bitgate see?
Everything that passes through: form values, uploaded files, result files and, when a tool keeps one, the run log. Files are deleted on the schedule above. Private in Button means only you and the people you invite have access, not that the data is hidden from us.
How do you control who can start a script?
Tools aren't public. The creator invites colleagues by email, and each one has to sign in with Google or a one-time email code using the address the invite went to. The creator can revoke access or set it to expire at any time.
Does the runner open a port on my computer?
No. The runner makes an outgoing, encrypted connection to Button. The only thing that listens is the setup page, on 127.0.0.1, while you use it.
Last updated