Everything a security reviewer needs, on one page
No sales call, no NDA. Vibgrate is an attestation product, so our own artifacts carry the same chain we build for our customers. Every image, chart, and binary is signed, carries SLSA build provenance, and ships a verifiable SBOM. Do not take our word for it — the commands to check are below.
What every artifact carries
The exact provenance chain Vibgrate produces for customer code — applied to our own supply chain.
Keyless signatures (cosign + Sigstore)
Every image, Helm chart, and release binary is signed with cosign using short-lived Fulcio certificates and recorded in the Rekor transparency log. No long-lived signing keys exist to leak — the identity is the GitHub OIDC token of the workflow that built it.
SLSA build provenance
Each artifact carries a signed SLSA provenance attestation linking it back to the exact source commit, workflow, and runner that produced it. Tampering anywhere between our build and your pull is detectable.
CycloneDX SBOM attestation
The Software Bill of Materials is generated by our own scanner ("we scan ourselves") and attached as a cosign attestation. The container you run carries the same machine-verifiable SBOM we produce for your code.
Signed by digest, mirrored by digest
We sign the immutable image digest, never a moving tag, and mirror that exact digest to secondary registries. A signature can never drift from the bytes it vouches for.
# 1. Verify the image was built by our pipeline, unmodified.
cosign verify ghcr.io/vibgrate/cli:latest \
--certificate-identity-regexp \
'https://github.com/vibgrate/cli/.github/workflows/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 2. Verify the CycloneDX SBOM attestation.
cosign verify-attestation --type cyclonedx ghcr.io/vibgrate/cli:latest \
--certificate-identity-regexp \
'https://github.com/vibgrate/cli/.github/workflows/.+' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
# 3. Verify SLSA build provenance.
gh attestation verify oci://ghcr.io/vibgrate/cli:latest \
--repo vibgrate/cliThe same three checks run as a gate inside our release workflow — an artifact that cannot be verified is never published.
Where to get the artifacts
Scanner image
ghcr.io/vibgrate/cli (canonical) · Docker Hub (mirror)
Multi-arch (amd64 + arm64). Tag equals the CLI version.
CLI package
@vibgrate/cli on npm
Published via npm trusted publishing (OIDC) with provenance.
SBOMs & checksums
GitHub Releases + OCI attestations
CycloneDX SBOM and SHA-256 checksums for every release.
The rest of the review pack
Signed artifacts are only half of what a reviewer asks for. Here is the other half.
What we receive
The code graph and a few scanners read parts of your source locally (code quality, database schema, UI text) — but only package names, versions, findings, scores, and structural facts ever reach our servers. Your source code stays on your machine. The remediation agent is the one exception, and it only runs when you ask.
How we handle your dataAccess and identity
Clerk for sign-in, including your own SSO. Role-based access control, checked on the server for every route. MFA required for administrators. Every write is logged.
Read the detailSubprocessors
Every company that handles data for us, what each one gets, and where. We say plainly which ones can see your code and which cannot.
See the registerPrivacy
We use Google Analytics and Cloudflare Web Analytics on vibgrate.com. Theme preference is stored locally. Full detail is in the privacy policy.
Privacy policyCertifications
We are not SOC 2 or ISO 27001 certified today. We will publish the report here when we are. In the meantime you can check every claim on this page against our source. We will also fill in your questionnaire. You do not have to book a call first.
Report a vulnerability
Write to security@vibgrate.com. We acknowledge within 3 business days and tell you what we found within 7. Report in good faith and we will not take legal action against you.