Security

Security at Vibecode

How we protect your account, your code, and your payments, and how to report a security issue to us.

Updated Reviewed by the Vibecode team

Security contact

Ansh Nanda

Co-founder and CEO, Vibecode

Ansh Nanda is Vibecode's official security contact. Send vulnerability reports and security questions to support@vibecodeapp.com, and start the subject line with “Security” so your report goes straight to the right person.

Report a security issue

How we protect you

Secure sign-in

Accounts run on Clerk, a dedicated authentication provider. Vibecode never stores your password, and every request for your account data is verified with a signed session token or an API key you created.

Payments we never touch

Web payments go through Stripe, and in-app purchases through the App Store and Google Play. Card numbers never reach our servers, and Stripe screens every web charge for fraud.

Encrypted in transit

Vibecode, our API, and the web apps you publish are all served over HTTPS. Payment and sign-in webhooks are verified before we act on them.

Isolated sandboxes

Each project's code runs in its own cloud sandbox, kept apart from other people's projects and from the systems that run Vibecode.

AI keys stay out of your code

Real AI model keys never enter a sandbox. Requests go through our proxy, which adds the key on our servers, so the code in your project only ever holds a placeholder.

Secrets don't travel with remixes

When someone remixes a public project, Vibecode clears every .env file in their copy, so your API keys and secrets stay yours.

Monitoring and abuse prevention

We monitor our services for errors and unusual activity, and automatically block card testing and payment abuse.

Limited access

Access to production systems and customer data is limited to the Vibecode engineers who need it to run the service.

Reporting a vulnerability

If you think you've found a security issue in Vibecode, email support@vibecodeapp.com with “Security” at the start of the subject. Please include:

  • What the issue is and what an attacker could do with it.
  • Steps to reproduce it, or a proof of concept.
  • The URLs, project IDs, or app versions involved.
  • How to reach you for follow-up questions.

What you can expect from us

  • We'll confirm we received your report within 3 business days.
  • We'll keep you updated while we investigate and fix it, and tell you when it's resolved.
  • If you'd like, we'll thank you by name once the fix is live.

Guidelines for researchers

  • Only test against accounts and projects you own.
  • Don't access, change, or delete other people's data. If you come across any, stop and tell us.
  • Don't run denial-of-service or load tests, send spam, or phish or socially engineer our team or users.
  • Give us a reasonable amount of time to fix the issue before you share it publicly.

If you follow these guidelines in good faith, we'll treat your research as authorized, work with you to understand and fix the issue, and won't take legal action against you for it.

Out of scope

  • Bugs in apps that Vibecode users build and publish, unless Vibecode itself causes them. Please contact the app's developer.
  • Vulnerabilities in services we use, such as Clerk or Stripe. Please report those to the provider.
  • Automated scanner output, or missing headers and best practices, without a working exploit.
  • Self-XSS, clickjacking on pages with no sensitive actions, and rate limits on non-sensitive endpoints.

We don't run a paid bug bounty program right now, but we read every report and are grateful for each one.

Keeping the apps you build secure

The apps you build with Vibecode are yours, and so are the choices about what data they collect. A few habits go a long way:

  • Keep API keys in your project's environment variables, never in code that ships to a phone or browser.
  • AI can write code with security mistakes. Review sign-in, payments, and anything that touches personal data before you publish.
  • Use a proven sign-in provider, such as the ones in Vibecode integrations, instead of writing your own.

Something wrong with your account?

If you see sign-ins, projects, or charges you don't recognize, email support@vibecodeapp.com or open live chat from Support right away and we'll help you secure it. To learn what data we collect and how we use it, read our Privacy Policy.

Build the first version today

Describe the app you want. Vibecode creates a working project you can preview and revise.

Start building