Safety
How we keep scans safe
A tool that looks for open doors has to be careful about whose doors it tries. These are the rules VibeShields is built on. They are enforced in the code, not just written here.
We only scan apps their owners have verified
Before the first scan you prove the app is yours by adding a DNS TXT record or a small file at a well-known address. We check that proof again right before every scan, so if you remove it, scanning stops.
For databases, naming one isn't enough. You add a small marker containing your app's verification token to your Supabase or Firebase project, and the scanner only tests databases that carry it.
The scanner only reads
- It sends GET requests only. It never posts forms, signs in, writes, updates or deletes.
- Every request has a timeout, and each scan has a hard cap on the number of requests.
- It refuses private and internal network addresses, so it can't be pointed at anything inside a private network.
- It backs off automatically when a site is slow or returns errors.
We don't keep your secrets or your users' data
- Leaked keys are stored masked, with only the first and last few characters kept, so you can recognise them.
- When a table is open, we record the table name and that it answered. We never store the rows.
- AI explanations are written from the type of problem only. Your evidence, URLs and data are never sent to the AI model.
Our own house is locked too
- The scanner runs in a separate, isolated worker that has no access to our main database.
- Every account's apps, scans and findings are separated at the database level with row level security.
- Sign-in uses one-time email links, and the public website holds no secrets at all.
- We attack-test VibeShields ourselves before releases and welcome outside reports.
What "Checked by VibeShields" means
The badge means your app was checked on the date it shows. It never reveals findings, and it isn't a guarantee: no scanner can prove an app is perfectly safe. That's why it says "Checked by" and nothing stronger.
Found a problem with VibeShields?
Email security@vibeshields.com with the steps to reproduce. We reply within three business days. See our disclosure policy. Please don't include real secrets or other people's data; masked values are enough.