Cypress Security Incident: Status and Response

Last updated: August 12, 2026. This page is our central record for this incident and will be updated as our investigation progresses.

We are writing to provide our users with a continued update on the security incident affecting Metabase, a third-party analytics tool we use internally, which we first notified affected organizations about on August 7,2026. We know that the security of your data is central to your trust in Cypress, and we appreciate your patience as we work through this together. 

We have completed our preliminary investigation and have found no evidence of ongoing unauthorized access to our systems and the incident does not affect how Cypress Cloud runs. You can continue running and recording your tests as usual. 

This page sets out to share progress from our  investigation, the actions we have taken, the steps we recommend users take, and answers to the most commonly asked questions. We will continue to update this page as our response progresses. 

What happened

Metabase is a third-party tool we use for analytics in our warehouses. On August 6, 2026, Metabase notified us of a security incident affecting our Metabase Cloud instance. According to Metabase, an attacker exploited a previously unknown vulnerability in its cloud platform on July 31, 2026. The vulnerability allowed the attacker to query a subset of the data in our instance.

Metabase provided us with logs of the activity and advised that it has since patched the vulnerability, blocked the method of access, and invalidated active sessions. You can read Metabase's own disclosure here: Metabase security update. 

What we have done to protect your data

As soon as Metabase notified us, we moved quickly to assess the impact and contain the incident, completing all actions recommended by Metabase and taking additional precautions of our own. These included: 

• Taking steps to confirm that Metabase patched the vulnerability and invalidated active sessions.
• Performing a thorough audit of access and activity logs of affected Cypress systems. 
• Rotating the database credentials and keys that connected the affected analytics environment. 
• Revoking the GitHub OAuth tokens used to sign in to Cypress Cloud, as a precaution. 
• Engaging an independent forensic firm to perform a thorough review of the incident 

With these measures in place, your workflows continue without interruption. You can run and record your tests on Cypress Cloud exactly as before, and the operation and results of your test runs remain unaffected.

What information was involved

Our investigation to date indicates that the attacker was able to access limited business and account data, repository and build metadata, and, in a subset of cases, certain tokens and test data. 

Based on our review, this incident did not affect the operation or results of Cypress test runs, Cypress record keys, Cypress Cloud account passwords, or any billing payment information. 

We are reaching out directly to the organizations impacted by this incident at the admin and owner level, and those customers can review the notice they receive for more information.

What we recommend you do

In addition to the guidance in our August 7 notice, we recommend the following: 

• Cypress Cloud sign-in (OAuth): no action is required. We revoked these authorizations as a precaution, so you may be asked to sign in again.
• Record keys: not affected. If you prefer to rotate, please follow the instructions here.
• Secrets in build parameters or test data: if you placed any credentials or secrets directly in build parameters or recorded test results, rotate them immediately.
• Version control access tokens used in CI: if you hardcoded a long-lived access token into a repository's remote URL your CI uses to clone your source, rotate it with your version control provider. Short-lived tokens your CI generates for each run expire on their own and do not require action.
• Review your version control access logs: check your version control and repository access logs for unauthorized access from July 31, 2026 through the completion of your token rotation.
• Watch for phishing: be cautious with unexpected messages that ask you to click a link or share credentials. If you receive an email asking you to sign in or reset your Cypress Cloud password, do not click the links in it. Instead, type cypress.io into your browser and sign in there. If you have any doubt about the authenticity or legitimacy of a communication that appears to come from Cypress, please contact us at [email protected] or reach out directly to your known contact at Cypress to confirm before taking action.

Additional security recommendations

Beyond the steps above, these practices reduce your exposure and limit the reach of any compromised credential:

• Prefer short-lived CI tokens. Where possible, use the short-lived token your CI provider issues per job rather than hardcoding a long-lived token into a repository's remote URL. Provider-issued tokens expire automatically when the job completes.
• Keep sensitive data out of build parameters and test data. Do not place secrets, credentials, PII, or PHI in your build parameters or test data. Recorded test data can include whatever your tests capture, so keep sensitive values out of it. You can find additional guidance on this here.
• Scope tokens to least privilege. Grant access tokens only the permissions the task requires, so an exposed token has limited reach.
• Review your Cypress Cloud access. Use roles and teams to limit who can see your projects and runs, remove users who no longer need access, and, where available on your plan, enable single sign-on (SSO). This keeps access to your Cypress Cloud data scoped to the people who need it.

What we are doing next

We have completed our preliminary investigation, and the findings on this page reflect that work. To give you added confidence in our response, we have engaged an independent forensic firm to perform a thorough review of the incident. 

We will also keep this page updated as our response continues, and if you have questions, you can reach us at [email protected].

Tim Gribble - CEO, Cypress.io 

Frequently asked questions