Regarding some of the actual claims, I had an issue a year back when I logged into a session, and could perfectly see another user's session in progress, internal url in the browser, mouse moving around.
I freaked out, watched for 3-4 seconds, and then got kicked out of the session.
I opened a ticket with support, and they got back to me saying they had "fixed the root cause".
I still use browserstack, but I'm really careful with passing along private credentials.
I've encountered similar oddities, seeing the remnants of other users' sessions, but no mouse movements so I guess they'd been recently terminated.
Also the VMs aren't locked down as tightly as they ought to be, last time I poked around in the Windows ones there were a few folders left writeable that shouldn't have been, ones with executables and scripts in used to control it.
That said, their service is so very useful that I continued using them anyway. My use case is just to occasionally check some public-facing websites are rendering properly on various browsers, so no big deal if someone snoops on that.
I really saw mouse movement and url typing, even though it was only a few seconds.
I raised the issue with them back in July 2013, but was initially brushed off. A couple more aggressive emails and they finally responded after 2 weeks saying the issue had been solved.
No worries!
Just pointing out the fact that they didn't seem too worried about the issue when first notified, and I really had to press to get some attention.
Same here, in Nov 2011. I contacted support, told them about it, and cancelled my account/sub right away back then -- I was using Browserstack for developing client sites and applications, and didn't feel like getting sued over a service I am using potentially leaking sensitive information.
I freaked out, watched for 3-4 seconds, and then got kicked out of the session.
I opened a ticket with support, and they got back to me saying they had "fixed the root cause".
I still use browserstack, but I'm really careful with passing along private credentials.