Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
The same release also fails closed on daemon shutdown, adds a health check, and lets you hide the Cloud live viewer.
Why now: The fix is in the August 26 release of browser-harness, version 0.1.10.
browser-harness 0.1.10 redacts CDP credentials from daemon logs, closing a leak that put full control of a browser session into any file, aggregator, or console that captured those logs. A CDP endpoint isn't a read-only debug hook. Whoever holds those credentials can drive the browser directly, click, type, read cookies, pull whatever's on screen.
The rest of the release is cleanup, not new capability. Orchestrator-owned daemons now fail closed on shutdown, so a killed parent process can't leave an unmanaged daemon running. There's a machine-readable health check for daemon status. The screenshot response timeout is split from the IPC connect timeout, so a slow screenshot no longer trips the same clock as a dead connection. You can also turn off the Cloud live viewer.
Five changes, and each one narrows something rather than adding to it, unusual for a point release this size. It reads like a team that found one real problem and swept the code for anything sitting next to it.
The release notes don't say how far back the plaintext logging goes, so treat any browser-harness daemon deployed before August 26 as having written raw CDP credentials to disk for its entire run. If those logs went to a shared aggregator, rotate whatever session tokens were live and pin 0.1.10 before running it again.
Each link below shares sources, entities, or timing with this story.
Shared entity: CDP / Same source domain / Shared topic / Earlier coverage
Both cover CDP; reported by the same outlet (github.com); overlapping topics (browser, capability).
Shared entity: Cloud / Shared topic / Earlier coverage
Both cover Cloud; overlapping topics (capability, check, cloud); earlier Cloud coverage from 2026-08-08.
Both cover Cloud; overlapping topics (browser, cloud, connect); earlier Cloud coverage from 2026-02-17.
Same source domain / Shared topic / Tension
Reported by the same outlet (github.com); overlapping topics (browser, closed, control); pushes against this story (against).
Shared entity: Cloud / Same source domain / Earlier coverage
Both cover Cloud; reported by the same outlet (github.com); earlier Cloud coverage from 2026-08-08.
Shared entity: Shipped August / Same source domain / Earlier coverage
Both cover Shipped August; reported by the same outlet (github.com); earlier Shipped August coverage from 2026-08-03.
Shared entity: Cloud / Same source domain / Earlier coverage
Both cover Cloud; reported by the same outlet (github.com); earlier Cloud coverage from 2026-07-27.
Both cover Cloud; reported by the same outlet (github.com); earlier Cloud coverage from 2026-07-27.