Built to review sensitive code safely.

VibeZero uses a GitHub App with minimal read-only repository permissions rather than personal access tokens. Repositories are cloned into ephemeral workspaces for requested scans and deleted after processing. We store scanner evidence and product records, not an ongoing copy of the full repository.

Source and runtime scanners run in isolated worker environments. Runtime checks are designed to be non-destructive, rate-limited, and restricted to verified targets. Private, loopback, link-local, and internal network destinations are blocked to reduce SSRF and unauthorized-scanning risk.

The free scanner at vibezero.io/scan is passive. It requests the page at the address you enter, follows ordinary redirects, and reads the same-origin scripts that page tells a browser to load. That is the whole of it: it does not guess at hidden paths, submit forms, attempt credentials, or send anything designed to affect the site. Every request it makes is one your own browser would have made by visiting.

Requests identify themselves as VibeZero-Scanner/1.0 in your access log. Private, loopback, link-local, and internal addresses are refused before any connection is opened, and each redirect hop is re-checked rather than trusted. Scans are limited per client and per target, and no scan result is stored: the report is returned to the browser that asked for it and nothing is written down.

Use it only on sites you own or are authorized to test. If you believe your site is being scanned without authorization, contact us and we will block the target.

Feature APIs are private by default. Requests are authenticated and checked against organization and project membership. Tenant-scoped database controls and row-level security are used to prevent cross-workspace access.

Secrets found during scans are masked in logs and user-facing evidence. GitHub and Stripe webhooks are authenticated with provider signatures. Per-project MCP credentials are scoped to the project and should be handled as secrets.

Customer code is accessed only to provide requested scans and is not used to train models. Ephemeral clones are deleted after scanning. Customers may request deletion of their project or account data, subject to limited legal, security, and accounting retention needs.

VibeZero marks a finding Verified Fixed only when a rescan confirms the expected security behavior. A moved task or claimed code change does not earn verified status. VibeZero does not claim that any scan proves an application is vulnerability-free.

To report a suspected vulnerability or ask about our controls, use our contact form. Please do not include active credentials or sensitive customer data in the initial message.