How we secure the platform that assesses yours
A security vendor that will not document its own controls is asking to be trusted on assertion alone. These are ours, at the level of detail we ask of customers.
Authentication
- Passwords hashed with bcrypt, twelve character minimum enforced
- Multi factor authentication available on every account, required for admin
- Sessions expire after 24 hours idle and 7 days absolute
- Login rate limited to 10 attempts, then locked out
- Sign out of every session from security settings
- Google sign in available
Data protection
- AES 256 encryption at rest
- TLS 1.3 in transit
- Application layer encryption on vulnerability records
- API key values are never stored, only the names you give them
- Code you paste into an audit is never stored or logged
- No passwords in plaintext, no card data, no protected health information
API security
- Row level security on every database table
- Rate limiting at 100 requests per minute per user
- CORS restricted to the vibelock.ai origin, no wildcards
- Content Security Policy, HSTS and X-Frame-Options enforced
- Input validated on every route
The agent
- Every message between the agent and the platform is HMAC signed
- Tokens are scoped to a single project
- The agent writes nothing to disk
- Communicates over HTTPS only
Infrastructure
- Dependency audit runs on every deployment
- Automated dependency monitoring on the repository
- HTTP redirected to HTTPS
- Managed hosting, no servers we patch by hand
What we store, and what we never store
The second column is the more consequential one: data that cannot be exposed in a breach, because it is never collected.
Stored, encrypted
- Account email and profile
- Project metadata: name, URL, stack selections
- Evidence states per control, with the commit each was verified at
- Finding titles and descriptions
- Standards coverage derived from verified controls
- Generated policy documents
- Security log entries
- API key names, for breach monitoring
Never stored
- API key values
- Code read from your repository during a scan, once repository scanning is switched on
- Passwords in any recoverable form
- Card numbers, which stay with our payment processor
- Protected health information
- Code read by your coding tool during verification
- Authentication tokens for your own services
GDPR
- Data minimisation
- We collect what the service needs to work, and nothing beyond it.
- Right to access
- Export everything we hold about you from account settings.
- Right to erasure
- Delete your account and everything attached to it from security settings.
- Breach notification
- We will notify affected users within 72 hours of becoming aware of a breach.
- Processing of your code
- When VibeLock launches, code from a connected repository will be read only, one commit at a time, by an isolated scanner, and discarded when the scan ends. It will not be stored or logged, and you will get an email every time it is read.
- Subprocessors
- Database, model provider, payments, email and hosting. Each one is named, with its role and location, in the subprocessor list.
The full detail is in the Privacy Policy and the subprocessor list.
Reporting a vulnerability
Email hello@vibelock.ai with the word security in the subject line. Every vibelock.ai domain and the API are in scope. Please do not test against another customer’s account or data.
What you get back
- Acknowledgement within 24 hours
- A resolution timeline within 72 hours
- Progress updates until it is closed
- Public credit in the security changelog, if you want it
We do not pursue legal action against researchers acting in good faith. Please give us reasonable time to fix an issue before disclosing it publicly.