Security at VibeSitter
The product watches your app. These are the rules we hold ourselves to while doing it.
Read-only access
Connected scans use read-only Supabase OAuth scopes. We never request write access and never ask for a service-role key or database password.
Encrypted credentials
Refresh tokens are encrypted at rest with AES-256-GCM. Tokens are never logged, shown in the UI, or included in emails.
No PII scanning
Checks inspect schema, policies, and configuration. We do not select customer rows or scan for personal data.
Bounded fetching
Surface scans use timeouts, response-size limits, and SSRF protections that reject private, loopback, and metadata addresses.
Minimal retention
Scan snapshots are pruned on a schedule. Deleting your account removes projects, scans, findings, alerts, and attempts to revoke the upstream OAuth grant.
Honest claims
VibeSitter is a configuration checker, not a penetration test or compliance certification. We do not claim otherwise.
Report a vulnerability to security@vibesitter.app. See also what we access and privacy.