vb.co

ViBe://SECURITY

What we do and do not store.

We collect only what we need to deliver your demo and quote. We do not store credentials, we do not have access to your production systems, and demo environments are isolated from anything live.

ViBe://AUDIT

Data storage, plainly stated.

STORED

$ vibe audit --show stored

✓ Demo request form data (name, email, phone, build description)

✓ Demo configuration choices (build type, color scheme, visual style)

✓ Email address — used to deliver demo output and quote

✓ Project scope details you provide during engagement

NOT STORED

$ vibe audit --show not-stored

✗ Passwords — we do not have a user account system

✗ Payment information — processed via third-party payment provider

✗ API keys or credentials belonging to your systems

✗ Employee personal data or HR records

✗ Healthcare records, financial records, or regulated data of any kind

✗ Demo output files after delivery — purged from build environment

// This list reflects current practice. It is not a legal certification or compliance attestation.

ViBe://ISOLATE

Demo environments are isolated.

Every demo build runs in an isolated environment with no connection to your production systems or any other client build. Generated files are delivered and then purged.

Build isolation

Each demo request generates in a separate ephemeral environment. No demo has access to another client's data, configuration, or output.

noindex enforcement

Demo preview URLs are served with noindex, nofollow headers. They are not indexed by search engines and are not publicly linked.

Output delivery and purge

Generated demo files are emailed to the address you provide. After delivery confirmation, build artifacts are removed from the generation environment.

No live system access

The demo builder does not request or store credentials for your production systems. It generates a static homepage concept using only the inputs you provide in the form.

ViBe://SECRETS

Secret handling in production builds.

When we build your production system, secrets (API keys, database credentials, authentication tokens) are stored in environment variables — never committed to source code or included in build artifacts.

  • Secrets stored in environment variables, not in code repositories
  • No secrets in demo builds — demos use placeholder values only
  • Secrets scoped to minimum required permissions
  • Rotation procedures documented at delivery
  • We do not retain copies of your production credentials after deployment

ViBe://REVIEW

Generated code is reviewed before it ships.

All AI-generated code is reviewed by a human engineer before it is deployed to any environment. Review covers correctness, security, and maintainability. We do not ship generated code directly to production without validation.

  • Manual review of all generated code before deployment
  • Security-specific review for authentication, input validation, and data access patterns
  • Dependency audit — no unreviewed third-party packages in critical paths
  • Generated business logic tested against edge cases before go-live

ViBe://HOST

Hosting security baseline.

All production systems we deploy meet a baseline security configuration. We do not make compliance certifications we have not earned.

TLS everywhere

All deployments use HTTPS with TLS 1.2 or higher. HTTP is redirected to HTTPS. Certificates are managed automatically.

Firewall rules

Infrastructure access is locked down via firewall rules. Only necessary ports are exposed. Management access is restricted by IP.

Dependency updates

Security patches are applied on a defined schedule. Critical patches are applied within 72 hours of public disclosure.

Access logging

Deployment and management actions are logged. Logs are retained for a minimum of 90 days.

Backups

Database and file backups are taken on a daily schedule with tested restore procedures.

No unsupported certifications

We do not claim SOC 2, HIPAA, PCI DSS, or any other compliance certification we have not independently audited and verified.

// Security questions specific to your project should be raised during the audit phase. Requirements that exceed this baseline are scoped and priced separately.

ViBe://REPORT

Found a security issue?

If you have identified a security vulnerability in our site or a system we operate, contact us directly at [email protected]. We will respond within one business day and address verified issues promptly.

// Please do not publicly disclose vulnerabilities before we have had a chance to address them.