Is this safe to run?
The code being tested is the code that crashes, not your machine. Here is exactly what runs and where.
- Reads your files
- Opens arbitrary network connections
- Runs unsigned code
- Uploads anything local
- Runs a signed target build
- Talks to the coordinator
- Mutates inputs from the shared corpus
- Reports coverage numbers
Browser workers
WebAssembly runs inside the same sandbox every website already uses. The worker has no access to your filesystem and no network reach beyond the coordinator. It executes the target build we compiled and signed, feeds it inputs, and reports which code paths lit up. Nothing from your machine leaves your machine.
Desktop workers
The desktop client executes only builds we compiled and signed ourselves, from repositories whose maintainers opted in. It never runs code a random contributor uploaded. When a target crashes, it is the target's bug, reproduced in isolation, not a problem with your computer.
What about the bugs themselves
Crash details are sensitive until they are fixed. Bonsai shows the public only that something was found: a name and a location. The input that triggers it, the stack trace, and the reproduction go to the maintainers privately and stay private until a fix ships. See Verification and disclosure.