Skip to main content
vibld
Sign up for the beta
Menu

← All legal documents

Security & Vulnerability Disclosure

Last updated

We take reports of security vulnerabilities seriously and appreciate the work of good-faith security researchers. This page explains how to report a vulnerability and what protection you have for doing so responsibly.

How to report

Email security@vibld.com with a description of the issue, the steps to reproduce it, and its potential impact. Please encrypt sensitive reports if possible, and avoid including data that is not your own beyond what is necessary to demonstrate the issue. A machine-readable version of this contact information is published at /.well-known/security.txt, per RFC 9116.

You can also report privately through GitHub, without a vibld account, at github.com/vibld/vibld/security/advisories/new. A draft advisory there is visible only to you and the maintainers.

What to expect

  • We will acknowledge a report within 3 business days.
  • We will investigate and keep you reasonably informed of progress.
  • We will let you know once the issue is resolved, and we welcome being credited unless you prefer otherwise.

Safe harbor

We will not pursue legal action against you for good-faith security research conducted in accordance with this policy, including testing, identifying, and reporting a vulnerability, provided that you:

  • Avoid privacy violations, destruction of data, and interruption or degradation of the Service;
  • Only interact with accounts and data you own or have explicit permission to access;
  • Give us a reasonable time to investigate and remediate before disclosing the issue publicly; and
  • Do not exploit a vulnerability beyond what is necessary to confirm it exists.

This safe harbor does not extend to third-party services we use (see our Subprocessors page). Report an issue in one of those directly to its own provider.

Scope

This policy covers:

  • this website (https://vibld.com);
  • the builder at https://app.vibld.com, and the API behind it;
  • previews, share links and published sites on vibld-preview.dev; and
  • vibld's source code at github.com/vibld/vibld.

Projects that users generate, preview or publish are their own code and are not in scope, except where one of them can reach something it should not: another user's data, the builder, or vibld's credentials.

How generated code is isolated

vibld treats every generated project as untrusted. Previews and published sites are served from vibld-preview.dev, a separate domain from vibld.com, so they never share cookies with the builder. A preview runs in its own Cloudflare container that can reach only the public npm registry, holds no vibld or model-provider credential, and has a 30-minute lifetime. Share links are signed, expire, and can be revoked. Model-provider keys stay on our servers and never reach the browser. A report that any of these does not hold is exactly what we want to hear.