Update on Heartbleed vulnerability

Posted by Natalie Nagele

We’ve been spending the last two days auditing and responding to the OpenSSL vulnerability that’s known as Heartbleed. This bug is notable because it is widespread (around 70% of the Internet uses Apache and Nginx, and by extension, OpenSSL) and can cause disclosure of sensitive data, including private keys and passwords. The issue has been assigned the following CVE identifier: CVE-2014-0160.

On Tuesday, April 8th, our initial action was to promptly begin applying security updates as they became available for the varying types of systems we use. As a precaution, we also cleared all logged in sessions for all accounts and users, this required everyone to login again.

We’ve audited our systems and currently have no indications of any unauthorized access, however as a precaution, we rekeyed and reissued all of our SSL certificates. Because of the SSL certificate update, if you’re using SVN you will most likely have to accept the new certificate next time you connect to the repository.

Out of an abundance of precaution, we do recommend resetting your password. And as a reminder, Beanstalk supports and encourages 2-step verification. Please enable it in your account.

We know this is affecting an incredible amount of apps and websites, many run by our own customers. If we can help you based on our own knowledge, please get in touch. And of course, if you have any concerns, please email support.

Announcing Git CDN: Faster Git hosting world-wide

Posted by Chris Nagele

We are thrilled to announce that our Git CDN is out of beta! No matter where you are in the world, any remote operation against your Git repositories will be automatically routed to the fastest servers, providing low latency and fast performance. We currently have clusters in Chicago, San Jose, Virginia, Amsterdam and Singapore with more on the way. After a long beta period, it’s now ready for anyone to use.

When we first came up with the idea for our Git CDN, the goal was simple: reduce latency and issues for customers who are far from our data center. Remote teams are very common and we have a large number of people using Beanstalk from India, Australia and many European countries. Beanstalk is built specifically for private distributed teams, so it was crucial we solved this problem.

Branch permissions for SVN

Posted by ilya sabanin

You asked and we listened. When we launched branch permissions for Git a couple of weeks ago, a lot of you have reached out to us and asked to add the same feature for SVN. We are launching it today.

Now you can restrict commit access to any branch (including trunk) in your SVN repository to allow only a certain group of people to commit to it. Everyone else will still be able to update, checkout and view contents of the restricted branch as usual, but they won’t be able to commit anything to it.

Branch permissions screenshot

Branch permissions for both SVN and Git are available on all plans. You can enable them by going to Settings > Permissions inside your repository. You have to be an admin or owner in order to access that page.

Teams API

Posted by Chris Ledet

Before teams, managing permissions for large number of users was a hassle. Every time you invited a user you had to specify which repositories that user can access. With the introduction of Teams all of these problems are now gone. Teams are a great way to organize your users into different groups to manage repository permissions.

Today, we’re proud to introduce our Teams API. Users can now create, update, and delete teams as well as add and remove users from a team.

Edit, Review, Merge and Deploy without ever touching command line

Posted by Chris Nagele

I’m a firm believer that you need to be a user of your own products. Without that, it’s extremely hard to both fine tune the small details and come up with the next big ideas. Yesterday I had the pleasure of releasing a new Beanstalk guide for WordPress deployments. The entire process was done through Beanstalk. I edited the changes, previewed the results in our design preview tool, merged the branch and deployed it to production. The best part, I never even opened a Git client or Terminal. It’s so rewarding to use your own product and get so much satisfaction from the value it provides. I want to share the process as an example.