Bruno
usebruno.comOpen-source, local-first API client that stores collections as plain text files and works seamlessly with Git. A privacy-focused alternative to cloud-based API tools.
- Homepage:usebruno.com
- GitHub:github.com/usebruno/bruno
- Web info:web-check.xyz/check/usebruno.com
Bruno Source Code
Author
Description
Opensource IDE For Exploring and Testing API's (lightweight alternative to Postman/Insomnia)
Homepage
https://www.usebruno.com/Repository
- LicenseMIT
- Created27 Sept 22
- Primary languageJavaScript
- Size66,684 KB
- Stars47,830
- Forks3,027
- Watchers47,830
Top Contributors
@helloanoop (1417)
@lohxt1 (344)
@pooja-bruno (252)
@naman-bruno (223)
@lohit-bruno (198)
@Pragadesh-45 (160)
@sanish-bruno (134)
@sid-bruno (127)
@sachin-thakur-bruno (113)
@abhishek-bruno (103)
@bijin-bruno (95)
@chirag-bruno (94)
@sanjaikumar-bruno (73)
@Gopi-bruno (72)
@gopu-bruno (66)
@shubh-bruno (62)
@sanjai0py (55)
@Its-treason (39)
@ravindra-bruno (36)
@utkarsh-bruno (34)
@sharan-bruno (33)
@devendra-bruno (32)
@ramki-bruno (32)
@barelyhuman (31)
@therealrinku (31)
@prateek-bruno (29)
@survivant (28)
@pietrygamat (25)
@sachin-bruno (23)
@ganesh-bruno (22)
@adwait-bruno (20)
@DogukanUrker (19)
@abhishekp-bruno (19)
@anusreesubash (18)
@anusree-bruno (18)
@maintainer-bruno (15)
@dcoomber (14)
@jsoref (14)
@sundram-bruno (13)
@sreelakshmi-bruno (13)
@morsh-bruno (12)
@n00o (11)
@dependabot[bot] (11)
@PChaparro (11)
@nelup20 (11)
@grubersjoe (11)
@ajaishankar (11)
@dozed (10)
@rreyn-bruno (10)
@NikHillAgar (10)
@snippetkid (9)
@Scotsoo (9)
@jwetzell (9)
@awinder (8)
@martinsefcik (8)
@baptpln (8)
@tlaloc911 (8)
@arnaduga (8)
@jokj624 (7)
@tpyle (7)
@lared (7)
@jeromed-weekera (6)
@mjhcorporate (6)
@cwilper (6)
@mvmn (6)
@brahma-dev (6)
@poojabela (5)
@Sl-Alex (5)
@notfounnd (5)
@jaktestowac (5)
@stupidly-logical (5)
@kapami (5)
@josbiz (5)
@fgrande (5)
@pongpayak-rsp (5)
@akshat-khosya (5)
@Beedhan (5)
@qweme32 (4)
@james-ha-bruno (4)
@dnnr1 (4)
@krummbar (4)
@vijayh-bruno (4)
@pkrisko (4)
@AyushNigam-1 (4)
@mirkogolze (4)
@depapp (4)
@end3rbyte (4)
@bplatta (4)
@nikischin (4)
@iamsushantk (4)
@helloitsm3 (4)
@mheidinger (4)
@luizfonseca (4)
@jarne (4)
@adarshlilha (4)
@BrandonGillis (4)
@acostinescu (4)
@rickyl3aks (3)
@Rohan-Bruno (3)
@dssagar93 (3)
Recent Commits
devsi-bruno(24 Oct 26)
chore: map BrowserStack test case ids and types onto generated e2e tests (#9603) * chore: map BrowserStack test case ids and types onto generated e2e tests Co-authored-by: Cursor <[email protected]> * chore: remove trailing space from test case id code span Co-authored-by: Cursor <[email protected]> * chore: set e2e tags only when the request mentions a type Co-authored-by: Cursor <[email protected]> * chore: drop the BrowserStack lookup line from the e2e skill Co-authored-by: Cursor <[email protected]> --------- Co-authored-by: Cursor <[email protected]>
sachin-thakur-bruno(23 Oct 26)
fix(import-environment): enter should not import the environment when focus is inside the modal (#9565) * fix(import-environment): enetr should not import the environment when focus is inside the modal * fix search height * fix env sidebar sizes * search valid files with env names and invalid files with file name
Mark Oliver Rodrigues(23 Oct 26)
fix(response): treat UTF-8 multi-byte characters as text in detection (#9367) * fix(response): treat UTF-8 multi-byte characters as text in detection A JSON response such as {"a":"测试"} served as application/json opens in the Raw format instead of JSON, while the same body with ASCII-only values opens as JSON. isLikelyText only counted printable ASCII and TAB/LF/CR as text and required more than 85% of the first 512 bytes to match, so every byte of a UTF-8 multi-byte character counted as binary. Short bodies with Chinese, Cyrillic, Japanese or emoji text fell under the threshold, detectContentTypeFromBase64 returned null, and useInitialResponseFormat treated that as "not ready", never mapping the content-type header to a format. Count complete, well-formed UTF-8 multi-byte sequences as text while walking the sample. Stray continuation bytes, invalid lead bytes and sequences cut off by the sample edge still count as non-text, so real binary data is still detected as binary. Fixes #9362 * fix(response): reject malformed UTF-8 sequences in text detection getUtf8SequenceLength only checked the lead byte and that the right number of continuation bytes followed it, so it also accepted overlong encodings (E0 80-9F, F0 80-8F), UTF-16 surrogates encoded as UTF-8 (ED A0-BF) and code points above U+10FFFF (F4 90-BF). Binary data made of those sequences could be reported as text. Check the second byte against the ranges Unicode allows after E0, ED, F0 and F4, so only well-formed sequences count as text. * test(response): tidy the content-type detection spec Build the invalid UTF-8 and missing-continuation fixtures with the existing repeatBytes helper instead of hand-written push loops; the byte arrays are identical. Derive the sample-boundary check in the long UTF-8 body test from the fixture's ASCII prefix, so it fails if the prefix changes such that the 512-byte sample no longer ends inside a multi-byte character. Move the SVG test under text detection, since SVG is treated as text (isBinaryContentType returns false for image/svg+xml).
Yogesh Patil(23 Oct 26)
fix: keep variable tooltips above the New Request modal (#9196) * fix: keep variable tooltips above the New Request modal Place body-mounted variable information above modals while keeping autocomplete hints above it. Add isolated Electron regressions for popup occlusion and interactions under the URL and across the dialog edge. Co-authored-by: Copilot App <[email protected]> * test: disambiguate CodeMirror autocomplete options Scope hint lookup to visible CodeMirror hint lists and match option names exactly. Exercise apiKey alongside apiKeyBackup so substring ambiguity fails the existing New Request regression. Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]>
Spooki(23 Oct 26)
Add keymap binding to run Prettify on request text (#8555) * Add keymap binding to run Prettify on request text * fix(prettify-shortcut): only prettify from the body editor, cover all request types
Utkarsh(23 Oct 26)
fix: implement parsing and validation for OpenAPI and Swagger specs (#9582)
Utkarsh(23 Oct 26)
fix: adding overflow for long names on confirm modal (#9605)
morsh-bruno(22 Oct 26)
feat(filestore): add the helper method writeCollectionToDisk * feat(filestore): add the helper method writeCollectionToDisk * feat(cli): use the writeCollectionToDisk for writing collections * feat(docs): update docs for the new helpers and examples * fix: add fixes for review comments
sachin-bruno(22 Oct 26)
fix: variables, secrets getting interpolated in openapi spec. (#9589)
Pragadesh-45(19 Oct 26)
fix(snap): make bundled git resolvable and add local snap build script (#9428)
Utkarsh(19 Oct 26)
fix: unit test case fix (#9573)
sachin-bruno(19 Oct 26)
fix(open-api): OpenAPI to Bruno conversion missing standard parameter serialization (#9400) * fix(converters): Make OpenAPI→Bruno conversion use correct default parameter serialization methods (#7783) * chore: remove merge-related comments * fix: make openapi to bruno conversion use correct default serialization methods for parameters --------- Co-authored-by: Arpit <[email protected]> * fix:OpenAPI to Bruno conversion missing standard parameter serialization (#9391) * fix: comments addressed * fix: comments addressed * fix: comments addressed * fix: comments addressed * fix: comments addressed --------- Co-authored-by: Alexander Roidl <[email protected]> Co-authored-by: Arpit <[email protected]>
ravindra-bruno(18 Oct 26)
fix(sidebar): scrolled to the active request reliably and centered it in view (#9557)
sachin-thakur-bruno(16 Oct 26)
feat(environment): add multi-select and context menu actions to environment list (#9541) * add action menu and actions hook to open modals * added multi selection hook and wired in collection env * added bulk delete modal * added e2e tests * added keyboard shortcuts * fix tests * code review comments * provide an option to create a env if search matches no env * renname on outside click * fix modal height * used common delete modal and refactor * refactor coments and delete modal * clear search after creating env * Update packages/bruno-app/src/components/Environments/Common/EnvironmentSelection/useEnvironmentActions/index.js Co-authored-by: Sid <[email protected]> * review comments resolved * code cleanup * Update packages/bruno-app/src/components/Environments/Common/EnvironmentSelection/useEnvironmentActions/index.js Co-authored-by: Sid <[email protected]> * moved to environment locators --------- Co-authored-by: Sid <[email protected]>
gopu-bruno(16 Oct 26)
feat(sidebar): show invalid counts on collections and folders (#9490)
gopu-bruno(15 Oct 26)
fix(mock-server): use in app modal instead of native close confirm (#9515) * fix(mock-server): use in app modal instead of native close confirm * fix(mock-server): add save option on close modal
ravindra-bruno(15 Oct 26)
feat(variables): added set as variable from a text selection (#9419) * feat(variables): added set as variable from a text selection * feat(variables): added set as variable from a text selection * test(variables): added e2e coverage for set as variable from a text selection * fix(variables): sized the set as variable menu to its content * fix(variables): hardened set as variable against nested braces, stale tabs and silent overwrites * refactor(variables): rebuilt the set as variable menu on MenuDropdown and corrected the copy action * fix(set-as-variable): stopped the tooltip opening under the menu and reused the existing scope styles * fix(set-as-variable): preserved value data types and replaced script selections with bru accessors --------- Co-authored-by: Utkarsh <[email protected]>
sachin-thakur-bruno(15 Oct 26)
feat(variables): add scoped variable autocomplete and single-brace trigger (#9267) * hooked enable sigle bracket * fixed replace text when cursor is in the middle * updated tests * updated ids * added double brace and by default single brace trigger on * moved svgs to icons folder * fix tests * refactor names * refactor
sachin-thakur-bruno(14 Oct 26)
fix(tests): multi select tests (#9546) * fix(tests): multi select tests * fixed in menu and create examples
ganesh(14 Oct 26)
Added changelog for 4.3.0 (#9463) * changelog for 4.3.0
adwait-bruno(14 Oct 26)
fix(openapi): tweak Create Spec modal dropdown height and active segment (#9529) * fix(openapi): tweak Create Spec modal dropdown height and active segment * Update packages/bruno-app/src/components/Sidebar/ApiSpecs/CreateApiSpec/StyledWrapper.js Co-authored-by: Bijin A B <[email protected]> --------- Co-authored-by: sachin-thakur-bruno <[email protected]> Co-authored-by: Bijin A B <[email protected]>
Prateek SU(14 Oct 26)
feat: improve multiple errors in response (#9504) * feat: improve multiple errors in response * fix: address review comments * fix: remove redundant timeouts + do a full-match for filePath * fix: use existing common constant for SCRIPT_TYPES.TEST
Pooja(13 Oct 26)
fix(auth): allow expanding OAuth2 token sections in inherited auth view (#9523) * fix(auth): allow expanding OAuth2 token sections in inherited auth view * fix
ravindra-bruno(13 Oct 26)
feat(sidebar): expanded collapsed ancestors to reveal the active request (#9394)
gopu-bruno(13 Oct 26)
fix(wsdl): add element namespaces to generated request bodies (#9456)
Abhishek Patil(12 Oct 26)
fix(save-collection):yml-collection-save-race-condition (#9431) * fix(save-collection):yml-collection-save-race-condition * refactor(tests): enhance save-collection-settings tests for saveMultipleCollections * UPDATE comment REMOVE cloneDeep step * refactor(auth): replace saveCollectionRoot with saveCollectionSettings
sanish chirayath(12 Oct 26)
feat: enhance OAuth2 token handling in processAuth function (#9454) * feat: enhance OAuth2 token handling in processAuth function - Introduced logic to set default tokenHeaderPrefix to 'Bearer' when absent and token is placed in the header. - Updated tests to validate new behavior for tokenHeaderPrefix and tokenPlacement. - Added a new fixture for OAuth2 folder to support round-trip testing. * fix: correct token placement logic in processAuth function - Updated tokenPlacement logic to default to 'url' when 'addTokenTo' is set to 'queryParams', otherwise defaults to 'header'. - Adjusted related tests to reflect the new default behavior for tokenPlacement and tokenHeaderPrefix. - Added a new test case to ensure correct default behavior when 'addTokenTo' is absent. * docs: update README.md for round-trip testing with Postman defaults
adwait-bruno(12 Oct 26)
fix(openapi):Create OpenAPI Spec Modal UI fixes (#9481) * fix(openapi):Create Modal UI fixes
Utkarsh(12 Oct 26)
fix: adding mock server to test (#9503)
Utkarsh(12 Oct 26)
fix: adding permission request handler on apps (#9470)
Bruno Security
Security Advisories (5)
- mediumPatched
GHSA-g747-7v24-2w4vOAuth2 state parameter is not validated on callback, allowing authorization code injection
- criticalPatchedCVSS 9.8
CVE-2026-34841Axios npm Supply Chain Incident Impacting @usebruno/cli
- criticalPatched
GHSA-246j-fv2m-6jhx SHA1-Hulud supply-chain compromise (transitive @postman/tunnel-agent) — Upgrade @usebruno/cli to 2.14.4
- highPatched
CVE-2025-30354Safe-Mode ignored in Asserts expressions
- highPatched
CVE-2025-30210XSS On Environment Name
Bruno Website
Website
Bruno - The Git-Native API Client
Bruno is the Git-native API client for REST, GraphQL, gRPC and Websocket. A local and open-source solution to Postman. Fast, developer-first, and no cloud syncing.
Redirects
Does not redirect
Security Checks
All 65 security checks passed
Server Details
- IP Address100.27.249.156
- Hostnameec2-100-27-249-156.compute-1.amazonaws.com
- LocationAshburn,Virginia,United States of America,NA
- ISPAmazon Technologies Inc.
- ASNAS14618
Associated Countries
US
CA
JP
Safety Score
Website marked as safe
100%
Trackers
Loads 4 third-party trackers
- ads-twitter.comTwitter, Inc.
- googletagmanager.comGoogle Ads
- linkedin.comMicrosoft Corporation
- redditstatic.comReddit Inc.
Blacklist Check
www.usebruno.com was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Bruno Reviews
More Developer Tools
Open-source offline toolbox for developers, with utilities for JSON, YAML, hashes, JWTs, Base64, text comparison and more. Useful alternative to pasting sensitive data into random online tools.
Push to GitHub anonymously: add gitGost as a git remote and it opens a pull request with your name, email and commit metadata stripped, optionally over Tor. Anonymity isn't perfect, and the hosted service has had abuse-related downtime.
About the Data: Bruno
Change History
- Moved from Developer Utilities › Developer Tools #639
Edit Bruno Data
You can edit Bruno's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Bruno's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/brunoThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Bruno
Help your friends compare Developer Tools, and pick privacy-respecting software and services.
Share Bruno and Awesome Privacy with your network!