Your source code stays on your machine
Vibgrate always reads your dependency manifests. A few extended scanners, and the code graph, also read parts of your source locally — to score code quality, map your database schema, and build the graph. None of that raw reading reaches our servers: what's received is package names and versions, computed scores and structural facts, and a set of findings. Never a full source file, a query, or a credential.
The one exception
Scanning, the dashboard, and Vibgrate AI Context never upload a source file — only computed scores, structural facts, and findings ever reach our servers. The remediation agent is different. When you ask it to write a fix, it clones your repository into an isolated virtual machine we control, makes the change, and hands you a pull request. That is the only time your code leaves your environment, it only happens when you ask, and the machine is torn down afterward. Who processes what →
One more detail: what actually gets read locally
The code graph (vg build/vg map) parses your source to build symbol/call-graph facts. The Code Quality scanner parses it for complexity metrics. If your repo has a Prisma schema, SQL migrations, a Drizzle schema, or TypeORM entities, the Database Schema scanner opens those files for table/column structure. The UI Purpose scanner reads component files for visible copy (button and heading text). Every one of these runs locally, on your machine, and every one keeps computed facts — never a query, a row of data, or a credential. Each is individually toggleable in vibgrate.config.ts. See exactly what each one reads →
What actually leaves your machine
Most scanners ask you to upload your repository. Vibgrate does not.
We receive
- Package names and versions
- Detected frameworks and language versions
- DriftScore components
- Project name and type
- Database table/column names and types, where you have a schema
- A capped set of short UI-copy samples (button/heading text) — only if the UI Purpose scanner is enabled
We do not receive
- Your business logic or algorithms
- A full source file, ever
- Your connection strings — the CLI strips them before upload
- Your environment variables or secrets
- Your customers' data
You do not have to take our word for it. The schema is in the CLI you install, and the CLI is open source.
How we protect it
Six things that are true today. Nothing on this page describes work we plan to do.
We receive metadata, not code
The Vibgrate CLI reads your manifests and lockfiles on your machine and sends a compact summary. The payload is validated against a closed schema on arrival — anything not on the list is rejected, not ignored.
Access is enforced on the server
Sign-in runs on Clerk — email, social, or your organization's SSO. Role-based access control covers 11 roles and 41 permissions, checked on every route. A user who is not a member of a workspace gets a 403, not a filtered view.
Administrators must use MFA
Privileged actions require multi-factor authentication. A session without it is refused at the permission check, not merely warned.
Encrypted in transit, encrypted at rest
Everything reaches us over TLS 1.3. We send HSTS with a two-year max-age and a preload directive, so browsers refuse to talk to us over plain HTTP. Your data rests in Cloudflare D1 and R2, encrypted at rest by the platform. Your ingest key is stored as a one-way hash for verification and an encrypted copy for read-back — we cannot recover it from the database alone.
Every write is logged
Changes are recorded with the actor, the action, and the timestamp. You can export your own events at any time, from your account, without asking us.
We scan ourselves with the product we sell you
Every commit is scanned for secrets before it can merge — a blocking gate, not an advisory one. Dependency advisories are reported on every change while we work down the existing backlog. Every release is signed: containers and Helm charts with keyless cosign signatures, npm packages with build provenance, each with an SBOM attached.
Where your data lives
Vibgrate Cloud runs on Cloudflare's global network. Your scan data is stored in our primary region today. If you use the optional remediation agent, that work runs in an AWS virtual machine.
EU-resident storage is built and not yet switched on. We will say so on this page the day it is.
Retention and deletion
You can export everything we hold about you at any time, from your account. No ticket, no waiting.
When you delete a workspace, we schedule the deletion and hold it through a grace window in case you change your mind. After that it is purged, and the audit trail of the deletion is kept.
Certifications
We are not SOC 2 or ISO 27001 certified today. We will publish the report here when we are. In the meantime, everything on this page is verifiable in our source, and we will complete your security questionnaire.
Ask us for what your review needsFound something?
Write to security@vibgrate.com. Please do not open a public issue.
Within 3 business days
What we found, within 7 business days
Report in good faith and we will not take legal action against you
Full policy: SECURITY.md
Verify any of this yourself
Our releases are signed and our SBOMs are published. The Trust Center has the commands to check a signature, read an SBOM, and confirm where a binary came from.