Security

1. What your agent sends

Your coding agent runs every check on your machine. Vibefilo receives only the results:

• For each finding: the rule id, severity, a short title, the file path and line number, and a short evidence excerpt (up to 2,000 characters) with secrets masked.
• Which rules were checked or not applicable, so the score counts only checks that ran.
• Project details you set: name, countries, business type and deployed URL.
• Fix verification results for each finding.

2. What is never sent

• Your source code. Vibefilo does not upload, clone or store your repository.
• Raw secrets. Evidence is masked before storage, and the agent is instructed never to include secret values.
• Environment variable values, databases or user data from your app.

3. How long we keep it

Projects, runs and findings are kept until you or your organization delete them, or the account is closed. Deleting a project or organization removes its findings and PDF reports. Deleted data can remain in database backups for up to 7 days. The Privacy Policy lists the retention of every other kind of data.

4. How we protect it

• Row level security on every table, so members only see their own organization.
• Agent tokens and API keys are stored only as hashes and can be revoked in the dashboard.
• PDF reports sit in a private bucket and are shared through short-lived links.
• All traffic uses TLS. Payments are handled by our payment provider, so we never see card details.
• Requests are rate limited and credit spending can be capped per day.

5. Report a vulnerability

Email support@vibefilo.dev with the details. We acknowledge reports within 3 working days and will not take action against good-faith research.