Repository read

Most founders never set up a build check, and many build in tools that have no MCP connection. So VibeLock can read the code itself: the default branch of one repository, read only, at one exact commit. It runs its checks on that commit in memory, keeps only the results, and discards the code. VibeLock never stores your code.

What it reads and what comes back#

• One repository you connect, on its default branch, one commit at a time.
• Results only: for each check, the verdict, the rule, the file path and the line. No code, no file contents and no secret values are kept.
• Exact package versions from your lockfiles, checked against a public vulnerability database using package names and versions only.
• Results count exactly like a build check: a pass here can corroborate your coding tool’s results.

The safeguards#

A separate read-only connection

Code is read through its own app on your repository host with read access to contents and metadata and nothing else. It cannot push, commit, open issues or change settings. The connection that reads security alerts never has access to code.

A key nobody can copy

The key for that connection lives in a cloud key vault, cannot be exported, and can only be used by the scanner. The web app and the database never hold it.

One repository, minutes long

Each scan gets a token limited to one repository and read access. It is never stored or logged, and it is revoked the moment the scan ends, including on error.

An isolated, throwaway scanner

Every scan runs in a fresh container that is destroyed afterwards, in a single region in the European Union. It has no database access and can reach only your repository host, the public package registry and vulnerability database, and VibeLock’s own scan endpoints.

Signed, single-use scan orders

The scanner acts only on an order signed by VibeLock naming one repository and one commit, valid for at most 5 minutes, and usable once.

You are the alarm

You get an email every time your code is read, naming the repository, the commit and the time. It cannot be turned off. VibeLock also alarms on any read without an order, any token not revoked, and unusual volume.

A kill switch

VibeLock can stop all reading at once. You can pause reading on your own repository at any time.

When it reads#

• Once when you connect.
• After a push to the default branch, at most once every 15 minutes and 8 times a day.
• A backstop scan every 6 days, so your evidence does not go stale.
• Choose "Scan only when I click" and only the scans you start yourself run.

What it does not do#

• It never writes to your repository.
• It never reads history: secrets in past commits are found through your repository host’s own secret alerts.
• It never reads a repository you did not connect, or a commit without a signed order.