Skip to main content

BugPin v1.3.0

BugPin v1.3.0 lets reporters record their screen from the widget, adds two-factor authentication with authenticator apps, recovery codes, and passkeys, and introduces a configurable password policy. It also tightens CORS, rate limiting, and static file handling, and makes widget submissions safe to retry.

The widget changes, including screen recording, ship in widget v1.2.0. The /widget.js served by BugPin v1.3.0 already includes them.

Before You Upgrade​

  • Follow the backup and recovery instructions. Recovery requires the previous image and its matching full data backup, including .secret; changing only the image does not undo database migrations.
  • Back up data/. The database is updated automatically on first start: new tables for two-factor authentication and passkeys, two new user columns, a submission id on reports, and capture details (time, duration, recording quality) on stored files.
  • Back up data/.secret together with the database. Authenticator app secrets are encrypted with it. Without it, authenticator apps stop working and users must sign in with a recovery code.
  • Check your reverse proxy upload limit. The server now accepts request bodies up to 256 MB, enough for one maximum-size video (100 MB) plus screenshots. Your proxy must accept uploads up to the configured video size and allow enough time for slower uploads. See Upload Size Limits.
  • Check the address warnings after upgrading. Administrators see a warning at the top of the Admin Console when the Application URL under Settings → General differs from the address in the browser, or when BugPin derives a different address from a request than the browser uses. Future BugPin versions rely on both, so resolve them before the next major upgrade. See Address Warnings in the Admin Console.
  • Check TRUST_PROXY. Rate limits use the connection address. Behind a reverse proxy, keep TRUST_PROXY=auto (the default, trusts private-network proxies) or set true. The quick-start docker-compose.yml sets TRUST_PROXY=false because it publishes port 7300 directly. See Client IP Addresses and TRUST_PROXY.
  • Cross-origin API calls. Only the widget API (/api/widget/*) answers cross-origin requests now. Scripts that call other endpoints from a browser on another origin must call them from a server with an API token instead.
  • Initial admin password. Admin accounts that still use the initial ADMIN_PASSWORD must set a new password at their next sign-in. Until then, their sessions and API tokens can only change the password or sign out.
  • Screen recording is off by default. Turn it on under Widget → Recording, or per project under Project Settings → Recording.
  • Security settings moved. The Security & Privacy page is now Security, and the EU Privacy Mode settings are under Settings → Privacy.

Features​

Screen Recording​

  • Reporters can record the page from a new Recordings tab in the widget and attach the clip to their report, with optional microphone audio. See Screen Recording.
  • New Widget → Recording page in the Admin Console with Enable Screen Recording, Video Quality (Low 720p, Standard 1080p, High 1440p), Max. Recording Duration (10 to 600 seconds), Max. Video Upload Size (1 to 100 MB), Daily Video Upload Limit per project, and Allow Microphone Recording. Each project can override these in a new Recording tab in Project Settings.
  • The server enforces the microphone and duration settings too, so a modified widget cannot bypass them.
  • The daily video upload limit is checked per project over a rolling 24 hours. Reports that exceed it are rejected with a clear message, and buffered offline reports are retried without their video.

Video Playback and GitHub​

  • Videos play in the report detail with seeking, served through byte-range requests.
  • Recordings are remuxed on the server with the new mediabunny dependency, so browser recordings that lack duration and seek information play correctly.
  • GitHub integrations have a new Public video links option. When it is on, issues link directly to the video; otherwise they link to the report in the Admin Console. Public links only work for reports sent to that repository and stop working when the option is turned off. See GitHub Integration.

Two-Factor Authentication and Passkeys​

  • Users can add an authenticator app in Profile → Security. The QR code is generated in the browser, and 10 single-use recovery codes are shown once and can be regenerated.
  • Passkeys can be added in Profile → Security and used to sign in without a password through Sign in with a passkey, or as the second step after the password.
  • Adding or removing a factor and regenerating recovery codes ask for the current password.
  • Security → Two-Factor can require a second factor for admins or for all users. Users the policy covers set one up at their next sign-in.
  • Admins can reset a user's two-factor authentication from Users, or with bun run reset-two-factor <email>. Both sign the user out of all sessions.

See Two-Factor Authentication and Passkeys.

Password Policy​

  • Security → Password Policy sets a minimum length (8 to 128 characters) and can require uppercase letters, lowercase letters, numbers, and special characters.
  • The policy applies to every new password: password changes, new users, invitations, admin resets, and bun run reset-password. Existing passwords keep working until they are changed.
  • The change-password and invitation forms show the rules while typing.

See Password Policy.

Changed​

  • The update banner identifies major upgrades with a celebration emoji and reminds administrators to review the upgrade instructions and back up their data. Its Upgrade guide link opens the new Upgrading page.
  • The warning about unsupported widget package versions has the same Not now button as the update banner, which hides it for a day.
  • BugPin refuses to start on a database that a newer version has already updated, and the log names the unknown migrations and any pre-upgrade snapshots stored beside the database. Before, an older version started on such a database and failed later. See Rolling Back.
  • The Security & Privacy page is now called Security (/security), with the tabs General, Two-Factor, and Password Policy. The EU Privacy Mode settings moved to Settings → Privacy. Bookmarks to the old /security-privacy address open the dashboard.
  • The report detail card for attachments is now titled Media. Each item shows when it was captured, its dimensions, size, and for videos the length and recording quality.
  • Number fields in the screenshot and recording settings keep what you type, flag out-of-range values inline, and only save valid values.
  • Turning on Use Custom Settings in a project's screenshot or recording settings copies the inherited values, so the override is saved even if nothing else changes.
  • The first admin account is set with ADMIN_EMAIL and ADMIN_PASSWORD (defaults [email protected] / changeme123). The initial password works once, and BugPin asks for a new one after the first sign-in. See Environment Variables.
  • The webhook editor (Enterprise Edition) keeps a saved signing secret when the field is left empty, and a new Remove secret link deletes it. Before, clearing the field removed the secret.

Fixes​

  • Saving an already resolved or closed report preserves its resolution or closure time and the original resolver.
  • Valid Chrome WebM recordings are no longer rejected by the remux step, which left some videos without duration and seeking.
  • The daily video quota can no longer be exceeded by uploads that arrive at the same time.
  • Video size limits stay editable when screen recording is off, since they also apply to uploaded videos.
  • Oversized uploads get a structured error instead of a bare HTTP 413.

Security​

  • CORS is limited to the widget API, without credentials. Before, every endpoint accepted cross-origin requests from any site with credentials allowed.
  • Static files under /admin/ and /branding/ can no longer be read outside their folders through encoded dot segments or separators.
  • Rate limits and the addresses recorded for sessions and invitations use the connection address. X-Forwarded-For and X-Real-IP are only honored from trusted proxies (TRUST_PROXY), and IPv6 clients are counted per /64 network.
  • Widget submissions are limited per visitor and project instead of per project key, so one visitor can no longer use up a project's limit for everyone.
  • Each sign-in endpoint has its own rate limit, and second-factor sign-in is locked for an account for 15 minutes after 10 failed attempts within 15 minutes.
  • Authenticator secrets are encrypted at rest (AES-256-GCM), and recovery codes are stored as hashes.
  • API tokens are refused while their user must change the password or set up two-factor authentication. A new password must differ from the current one.
  • Public video links only serve videos of reports linked to a GitHub issue in a repository whose integration allows them, and browsers cache them for 5 minutes instead of 24 hours, so revoking takes effect quickly.
  • Webhook API responses (Enterprise Edition) no longer include the signing secret. They return secretSet instead, which tells whether a secret is saved.
  • Remux runs one recording at a time to keep memory use predictable, and range reads from S3 storage are capped at 8 MB per response.

Maintenance​

  • HEAD requests for stored files return headers without reading storage.
  • Docker images are also tagged with the major and minor version (1 and 1.3), so an installation can follow one release line instead of latest. See Docker Image Tags.
  • Widget reports carry a submissionId, and the server answers a repeated submission with the existing report instead of creating a second one. See Widget API.

How to Upgrade​

Back up data/, including data/.secret, then follow Upgrading BugPin for Docker, Bun, or systemd.

Use Bun 1.4.4 for source installations.

We use cookies for analytics to improve our website. More information in our Privacy Policy.