Trust Center

VibeZero uses a GitHub App with minimal read-only repository permissions rather than personal access tokens. Repositories are cloned into ephemeral workspaces for requested scans and deleted after processing. We store scanner evidence and product records, not an ongoing copy of the full repository.

Source and runtime scanners run in isolated worker environments. Runtime checks are designed to be non-destructive, rate-limited, and restricted to verified targets. Private, loopback, link-local, and internal network destinations are blocked to reduce SSRF and unauthorized-scanning risk.

Feature APIs are private by default. Requests are authenticated and checked against organization and project membership. Tenant-scoped database controls and row-level security are used to prevent cross-workspace access.

Secrets found during scans are masked in logs and user-facing evidence. GitHub and Stripe webhooks are authenticated with provider signatures. Per-project MCP credentials are scoped to the project and should be handled as secrets.

Customer code is accessed only to provide requested scans and is not used to train models. Ephemeral clones are deleted after scanning. Customers may request deletion of their project or account data, subject to limited legal, security, and accounting retention needs.

VibeZero marks a finding Verified Fixed only when a rescan confirms the expected security behavior. A moved task or claimed code change does not earn verified status. VibeZero does not claim that any scan proves an application is vulnerability-free.

To report a suspected vulnerability or ask about our controls, email sales@vibezero.io. Please do not include active credentials or sensitive customer data in the initial message.