Security

Bussin is a static web application that runs entirely in your browser. All connection credentials, tokens, and message payloads are processed locally. No backend servers, proxy relays, or databases are used to store your data.

Data Flow

All network traffic flows directly between your browser and Microsoft Azure's cloud endpoints. We do not run middle-tier servers that intercept or process your messages. There is no external infrastructure that can access or leak your messaging payload.

No Message Storage

Zero Service Bus entity names, queue definitions, metadata, or message body payloads are ever sent to or stored on our servers. All message data retrieved from Azure is held strictly in your browser's volatile memory and is cleared when you close the tab.

Telemetry and Analytics

We use Google Analytics to track general website usage and help improve the site. However, no Azure Service Bus connection details, access keys, or message payloads are ever sent to Google Analytics or any other third-party services.

Browser-Only Execution

Because Bussin runs as a standard static web application, it inherits the sandbox protections enforced by modern browser engines:

Same-Origin Isolation: Cross-origin resource sharing (CORS) rules prevent other websites or scripts from accessing Bussin's memory space or local storage.
TLS Encryption: All communication with Microsoft management and data endpoints is secured via standard browser-enforced TLS 1.2 or 1.3 channels.

Microsoft Authentication Model

MSAL.js handles sign-in directly within your browser's security context. The acquired OAuth 2.0 access token is used locally to connect to Azure. Your credentials never pass through external servers, and access rights conform strictly to your active Azure Role-Based Access Control (RBAC) permissions.

Data Caching

Token Caching: Uses the Microsoft Authentication Library (MSAL.js) to request standard OAuth 2.0 tokens. Access tokens for Service Bus actions are stored only in temporary session memory.
Local Caching: Saves your namespace bookmarks, workspace folder layouts, and settings inside your browser's local localStorage.

Open Source and Auditability

Bussin is open source. Security teams and developers are encouraged to audit the codebase or self-host the static client:

Bussin App Core: Audit the client-side WebAssembly rendering, AMQP protocol logic, and local storage configurations: github.com/sgebb/bussin
Bussin Static Site: Audit this documentation site and static landing pages: github.com/sgebb/bussin-site