Security and AI Disclaimer

1. Scan results are evidence at a point in time

A scan examines only what it can reach at the time it runs, and where it reads code, at one commit. It can miss weaknesses, and a finding can be wrong. An application can change minutes after a scan. A result, a coverage figure or an open finding count describes what was observed then, and says nothing about anything VibeLock did not examine.

VibeLock does not run active attacks by default and is not a penetration test, a code audit or a security assessment by a qualified professional.

2. Badges and trust pages

The VibeLock Verified badge means that, at the date shown, the published badge criteria held for the application named on its verification page. A badge showing a last verified date means they last all held on that date. The live verification link is the only proof of either state; a screenshot or a copy proves nothing.

A badge or trust page is not a certification, an audit, an attestation, an endorsement of the application or of the company behind it, or a statement that the application is secure. VibeLock does not say any application or organisation is compliant, certified or aligned with any law, standard or framework.

If you are deciding whether to trust, buy from, invest in or share data with a company, a badge or trust page is one piece of information among many. Make your own enquiries. VibeLock owes no duty to visitors of a trust page and is not liable to them for any decision they make.

3. AI generated content

Some results in the Service come from AI models: the reading of documents you publish for comparison with verified evidence. Generated policies are filled from a fixed template and fix prompts from a fixed library; no AI model writes either. Fix prompts are instructions for your own coding tool, which may use AI. AI output can be inaccurate, incomplete or out of date. Review it before you rely on it, and test any change a fix prompt leads to before you deploy it. Our AI Transparency Notice lists where AI is used and how to ask for a human review.

4. Not legal or professional advice

Nothing VibeLock publishes or generates is legal, regulatory, financial or professional advice. Generated policies are drafts that have not been reviewed by a lawyer. VibeLock is not a law firm, an auditor, a certification body or a notified body. Where a law or a customer requires a professional opinion, get one from a qualified person.

5. Educational content

Our blog, guides, glossary, documentation, the free Vibe Coding Security Checklist and the Vibe Coding Security OS are general information about application security. They are not tailored to your application, may become out of date, and are provided without any promise that following them will prevent a security incident. Some articles on our blog are drafted with AI from cited sources and then checked, edited and approved by VibeLock before publication. Those articles say so at the top.

Do not use any technique we describe on a system you do not own or are not authorised in writing to test.

6. Frameworks and third parties

Where we refer to a published standard, law or framework, such as the OWASP standards, the GDPR or the EU AI Act, we do so to show where a check comes from. Their authors have not reviewed or endorsed VibeLock. The coding tools and other products we mention, such as Claude Code, Cursor, Windsurf, Copilot, Lovable, Bolt, v0 and Replit, belong to their owners, who are not affiliated with VibeLock.

7. Limits of liability

To the maximum extent permitted by law, VibeLock LLC is not liable for any loss arising from reliance on a scan result, a badge, a trust page, AI output or educational content. For customers, the Terms of Service set out our full warranty disclaimer and limitation of liability, and they prevail over this page where they differ. Nothing here limits liability that cannot be limited by law.

8. Contact

Entity

VibeLock LLC, a Delaware limited liability company

Questions

hello@vibelock.ai