Cypress Security Incident: Status and Response

Last updated: August 17, 2026. This page is our central record for this incident and will be updated as our investigation progresses.

Security Incident Update: August 17, 2026

As our investigation continues, we are expanding on two parts of our previous  post that have prompted the most questions: what the test data encompasses, and how Cypress records the repository URL associated with your runs.

What “test data” encompasses

Test data, also referred to as recorded test content, is data associated with your recorded runs that resided in the analytics environment involved in this incident, specifically test bodies and hooks. It is separate from test artifacts (Test Replays, screenshots, videos, and console logs), which were not affected.

This data is isolated to the compiled source of your test bodies and hooks. To see exactly what is captured for any given test, open the test in Cypress Cloud and select "Test definition" in the Test Detail sidebar.

The following are not included in recorded test content:

• Fixture file contents, which are read from your repository at execution time.
• Values that are loaded or passed into a test at runtime rather than written literally in the test source, including values accessed through Cypress.env() and cy.env().

How the repository URL is recorded

Cypress records a repository's remote URL as part of your build metadata from continuous integration (CI) environments, and these URLs sometimes contain a version control access token. In the current version, the remote repository URL for a run is resolved in the following order:

1. The Git value, taken first from the COMMIT_INFO_REMOTE environment variable and otherwise from git config --get remote.origin.url. The latter is sanitized to strip embedded credentials.
2. The CI provider's remote-origin environment variable, used only when the Git value is empty.
3. Null, if neither is available.

When the CI provider value is used, the environment variable read depends on your provider:

For CI providers not listed above, only the git value is utilized.

Security Incident Update: August 12, 2026

We are writing to provide our users with a continued update on the security incident affecting Metabase, a third-party analytics tool we use internally, which we first notified affected organizations about on August 7,2026. We know that the security of your data is central to your trust in Cypress, and we appreciate your patience as we work through this together. 

We have completed our preliminary investigation and have found no evidence of ongoing unauthorized access to our systems and the incident does not affect how Cypress Cloud runs. You can continue running and recording your tests as usual. 

This page sets out to share progress from our  investigation, the actions we have taken, the steps we recommend users take, and answers to the most commonly asked questions. We will continue to update this page as our response progresses. 

What happened

Metabase is a third-party tool we use for analytics in our warehouses. On August 6, 2026, Metabase notified us of a security incident affecting our Metabase Cloud instance. According to Metabase, an attacker exploited a previously unknown vulnerability in its cloud platform on July 31, 2026. The vulnerability allowed the attacker to query a subset of the data in our instance.

Metabase provided us with logs of the activity and advised that it has since patched the vulnerability, blocked the method of access, and invalidated active sessions. You can read Metabase's own disclosure here: Metabase security update. 

What we have done to protect your data

As soon as Metabase notified us, we moved quickly to assess the impact and contain the incident, completing all actions recommended by Metabase and taking additional precautions of our own. These included: 

• Taking steps to confirm that Metabase patched the vulnerability and invalidated active sessions.
• Performing a thorough audit of access and activity logs of affected Cypress systems. 
• Rotating the database credentials and keys that connected the affected analytics environment. 
• Revoking the GitHub OAuth tokens used to sign in to Cypress Cloud, as a precaution. 
• Engaging an independent forensic firm to perform a thorough review of the incident 

With these measures in place, your workflows continue without interruption. You can run and record your tests on Cypress Cloud exactly as before, and the operation and results of your test runs remain unaffected.

What information was involved

Our investigation to date indicates that the attacker was able to access limited business and account data, repository and build metadata, and, in a subset of cases, certain tokens and test data. 

Based on our review, this incident did not affect the operation or results of Cypress test runs, Cypress record keys, Cypress Cloud account passwords, or any billing payment information. 

We have already reached out directly to the organizations impacted by this incident at the admin and owner level, and those customers can review the notice they received for more information.

What we recommend you do

In addition to the guidance in our August 7 notice, we recommend the following: 

• Cypress Cloud sign-in (OAuth): no action is required. We revoked these authorizations as a precaution, so you may be asked to sign in again.
• Record keys: not affected. If you prefer to rotate, please follow the instructions here.
• Secrets in build parameters or test data: if you placed any credentials or secrets directly in build parameters or recorded test results, rotate them immediately.
• Version control access tokens used in CI: if you hardcoded a long-lived access token into a repository's remote URL your CI uses to clone your source, rotate it with your version control provider. Short-lived tokens your CI generates for each run expire on their own and do not require action.
• Review your version control access logs: check your version control and repository access logs for unauthorized access from July 31, 2026 through the completion of your token rotation.
• Watch for phishing: be cautious with unexpected messages that ask you to click a link or share credentials. If you receive an email asking you to sign in or reset your Cypress Cloud password, do not click the links in it. Instead, type cypress.io into your browser and sign in there. If you have any doubt about the authenticity or legitimacy of a communication that appears to come from Cypress, please contact us at [email protected] or reach out directly to your known contact at Cypress to confirm before taking action.

Additional security recommendations

Beyond the steps above, these practices reduce your exposure and limit the reach of any compromised credential:

• Prefer short-lived CI tokens. Where possible, use the short-lived token your CI provider issues per job rather than hardcoding a long-lived token into a repository's remote URL. Provider-issued tokens expire automatically when the job completes.
• Keep sensitive data out of build parameters and test data. Do not place secrets, credentials, PII, or PHI in your build parameters or test data. Recorded test data can include whatever your tests capture, so keep sensitive values out of it. You can find additional guidance on this here.
• Scope tokens to least privilege. Grant access tokens only the permissions the task requires, so an exposed token has limited reach.
• Review your Cypress Cloud access. Use roles and teams to limit who can see your projects and runs, remove users who no longer need access, and, where available on your plan, enable single sign-on (SSO). This keeps access to your Cypress Cloud data scoped to the people who need it.

What we are doing next

We have completed our preliminary investigation, and the findings on this page reflect that work. To give you added confidence in our response, we have engaged an independent forensic firm to perform a thorough review of the incident. 

We will also keep this page updated as our response continues, and if you have questions, you can reach us at [email protected].

Tim Gribble - CEO, Cypress.io 

Frequently asked questions