This page is maintained by the VibeCoden't team to answer common security questions about the Service. It is not an independent certification.
Account security
- Email + password and Google sign-in, with sessions handled by our managed auth provider.
- Passwords are hashed; we never see or store them in plaintext.
- Per-user rate limits and daily allowances on scan actions to mitigate abuse.
- Administrative access is granted through a separate roles table and checked on the server for every admin action.
Data protection
- TLS in transit; encrypted storage at rest.
- Row-level security ensures users can only read their own scans, credits, subscriptions and keys.
- Scan history is append-only; completed scan records cannot be modified.
- Backend secrets are stored server-side and never shipped to the browser.
- API keys for the GitHub integration are stored hashed and shown in full only once, at creation.
- Findings redact sensitive evidence such as keys and tokens, and reference code by hashed or shortened location rather than storing your source.
How we run scans safely
- Targets are resolved and checked before we connect, so scans cannot be redirected at private or internal infrastructure.
- Responses are read with size and time limits, and large or binary files are skipped rather than downloaded.
- Code scans cap the number of files, file size and findings per run.
- We only make read-only requests to the target; we never attempt to exploit, modify or damage anything.
Agent and integration access
- AI agent (MCP) access requires your explicit consent and acts only within your account's entitlements.
- Agent tool calls are validated server-side, capped in request size, and rate limited per user and per hour.
- Repository and pull request scanning is verified against your active plan on every request and stops immediately when a plan ends.
Payments
Payments are processed by Stripe. Card details are entered on Stripe's pages and never reach our servers; we store only the resulting purchase and plan records.
Responsible disclosure
If you believe you've found a vulnerability in VibeCoden't itself, please email contact.vibecodent@gmail.com with steps to reproduce. Please do not test against other users' accounts or data, do not run destructive or high-volume tests, and give us a reasonable chance to fix the issue before disclosing it publicly. We aim to acknowledge reports within a few business days.