Security

How we secure the platform that assesses yours

A security vendor that will not document its own controls is asking to be trusted on assertion alone. These are ours, at the level of detail we ask of customers.

Authentication

  • Passwords hashed with bcrypt, twelve character minimum enforced
  • Multi factor authentication available on every account, required for admin
  • Sessions expire after 24 hours idle and 7 days absolute
  • Login rate limited to 10 attempts, then locked out
  • Sign out of every session from security settings
  • Google sign in available

Data protection

  • AES 256 encryption at rest
  • TLS 1.3 in transit
  • Application layer encryption on vulnerability records
  • API key values are never stored, only the names you give them
  • Code you paste into an audit is never stored or logged
  • No passwords in plaintext, no card data, no protected health information

API security

  • Row level security on every database table
  • Rate limiting at 100 requests per minute per user
  • CORS restricted to the vibelock.ai origin, no wildcards
  • Content Security Policy, HSTS and X-Frame-Options enforced
  • Input validated on every route

The agent

  • Every message between the agent and the platform is HMAC signed
  • Tokens are scoped to a single project
  • The agent writes nothing to disk
  • Communicates over HTTPS only

Infrastructure

  • Dependency audit runs on every deployment
  • Automated dependency monitoring on the repository
  • HTTP redirected to HTTPS
  • Managed hosting, no servers we patch by hand

What we store, and what we never store

The second column is the more consequential one: data that cannot be exposed in a breach, because it is never collected.

Stored, encrypted
  • Account email and profile
  • Project metadata: name, URL, stack selections
  • Evidence states per control, with the commit each was verified at
  • Finding titles and descriptions
  • Standards coverage derived from verified controls
  • Generated policy documents
  • Security log entries
  • API key names, for breach monitoring
Never stored
  • API key values
  • Source code you paste into an audit
  • Passwords in any recoverable form
  • Card numbers, which stay with Stripe
  • Protected health information
  • Code read by your coding tool during verification
  • Authentication tokens for your own services

GDPR

Data minimisation
We collect what the service needs to work, and nothing beyond it.
Right to access
Export everything we hold about you from account settings.
Right to erasure
Delete your account and everything attached to it from security settings.
Breach notification
We will notify affected users within 72 hours of confirming a breach.
Processing of your code
Code submitted for analysis is processed and discarded in the same request. It is not stored and it is not logged.
Subprocessors
Database, model provider, payments, email and hosting. Each one is named, with its role and location, in the subprocessor list.

The full detail is in the Privacy Policy and the subprocessor list.

Reporting a vulnerability

Email security@vibelock.ai. Every vibelock.ai domain, the agent package and the API are in scope. Please do not test against another customer’s account or data.

What you get back
  • Acknowledgement within 24 hours
  • A resolution timeline within 72 hours
  • Progress updates until it is closed
  • Public credit in the security changelog, if you want it

We do not pursue legal action against researchers acting in good faith. Please give us reasonable time to fix an issue before disclosing it publicly.

More