FAQGet early access

VTSecurity & privacy

Your code is evidence. Keep it in your custody.

VibeTect is built on local-first analysis. This page explains exactly what that means, where its limits are, how this website handles your data, and how to reach us about security.

01The model

Local-first, explained without the marketing.

The desktop app inspects your project on the computer it’s installed on. Analysis doesn’t depend on uploading your source code to VibeTect’s servers or connecting a third-party service to your repositories.

That design choice matters most for the code you’re least able to share: unreleased products, client work and anything under a confidentiality agreement.

Your device
  1. InputYour project folderSource and configuration files, as they are on disk.
  2. AnalysisVibeTect desktop appInspects the project with your machine’s own resources.
  3. OutputFindingsSeverity, location, explanation and fix guidance.
Uploading source codeNot required for analysis
Diagram: your project folder is analyzed by the VibeTect desktop app on your own device, producing findings on that device. Uploading source code to a remote server is not required for analysis.

Chain of custody

Your source code
Stays on your device. The desktop app reads it from the folder you choose in order to analyze it.
The analysis
Runs on your device, using your machine’s own resources.
Findings
Generated on your device, alongside the project they describe.
Repository credentials
Not needed. VibeTect works from a local folder, not a connection to your Git host.

02Benefits and limits

What local analysis protects — and what it can’t see.

Benefits

  • Privacy by architecture. Source code doesn’t need to leave your device to be checked.
  • No standing access. Nothing to revoke later, because no repository permissions were granted.
  • Confidential code welcome. Check client and pre-launch projects without sending them to another service.
  • Check any time. Run it before a deploy, on a branch, or on an exported project — wherever the code is.

Limits

  • Project files only. Settings that exist only in a hosting, database or storage dashboard aren’t in your folder.
  • No live testing. VibeTect doesn’t probe your deployed application or infrastructure.
  • Coverage varies by release. The languages, frameworks and checks supported are listed per release.
  • Not a guarantee. Automated analysis can miss issues — especially ones that depend on business rules.

Our recommendation: use VibeTect before every deploy, review platform settings where they live, and commission a professional security assessment for systems that handle sensitive data at scale.

03Due diligence

Six questions to ask any security tool — including this one.

Security products ask for an unusual amount of trust. These are the questions we’d ask before installing anything that reads our code.

  1. Q01

    Where does my code go?

    A tool that inspects source code should tell you plainly whether that code leaves your machine — and why.

  2. Q02

    What access does it ask for?

    Broad repository or organization scopes deserve scrutiny. Ask whether the job really requires them.

  3. Q03

    Can I verify what I install?

    Download only from the vendor’s own site and compare published checksums where they’re provided.

  4. Q04

    What does it claim — and can it back it up?

    Certifications, customer logos and detection rates should be verifiable. Missing evidence is information too.

  5. Q05

    What doesn’t it cover?

    Every tool has blind spots. A vendor that won’t name them is asking for trust it hasn’t earned.

  6. Q06

    Who do I contact about a vulnerability?

    A real disclosure address — and a security.txt file — show a vendor expects to be held accountable.

VibeTect doesn’t currently claim any third-party security certification. If that changes, the details will be published here — with evidence.

04This website

What vibetect.com collects.

The website and the desktop app are separate. Here’s what this site does with your data.

Cookies
This site doesn’t set cookies.
Analytics
This site currently runs no analytics scripts.
Early-access requests
If you request early access, we receive the email address and details you submit and use them to contact you about VibeTect.
Third-party code
Fonts and scripts are served from this domain. A strict Content Security Policy limits what the pages can load.
Read the website privacy notice

05Responsible disclosure

Found a vulnerability? Tell us first.

If you believe you’ve found a security issue in VibeTect or vibetect.com, please report it privately so we can investigate and fix it before it’s disclosed publicly.

security@vibetect.com

Machine-readable contact details: /.well-known/security.txt

A useful report includes

  • The affected product, version or URL
  • Steps to reproduce the issue
  • The impact you believe it has
  • Any proof-of-concept code or screenshots

We ask that you

  • Act in good faith and avoid privacy violations or service disruption
  • Access only the minimum data needed to demonstrate the issue
  • Give us reasonable time to fix it before any public disclosure

Private by design. Ready when you are.

Run a local security inspection on the project you’re about to deploy — and fix what it finds while it’s still cheap to fix.

Get early accessRead the vibe coding security checklist

Local analysis · No repository access required