Security Policy

Last updated: September 28, 2026

Reporting a vulnerability

Email security@vibe-coded.ai with a description of the issue and its impact, steps to reproduce (a proof of concept if you have one), and the name or handle you'd like credited (or "anonymous").

We aim to acknowledge reports within 48 hours and to ship a fix or mitigation as quickly as the severity requires. For critical issues we agree disclosure timing with you.

Scope

In scope:

  • The platform at vibe-coded.ai and api.vibe-coded.ai
  • The OAuth server at oauth.vibe-coded.ai
  • Platform subdomains, including admin.vibe-coded.ai and the system vibes at platform--*.vibe-coded.ai
  • The runtime that hosts vibes, including isolation between accounts and vibes
  • MCP endpoints and connections (/mcp on vibe hosts)
  • Authentication and authorization: sessions, CLI and connection tokens, sharing and permissions
  • The vibe command-line tool and installer

Out of scope:

  • Vibes published by users. They are user code; report issues in them to the vibe's owner. Report anything that lets one vibe reach another account's data to us.
  • Third-party services we rely on (such as Cloudflare, Stripe, Google, or GitHub). Report those to the provider.
  • Denial-of-service, spam, and social-engineering attacks

Rewards

We pay rewards for verified vulnerabilities at our discretion, typically:

  • $100–$500 for privilege escalation, cross-account data access, or authentication bypass
  • $50–$250 for CSRF, CORS, or session-handling issues
  • $25–$100 for leaks of sensitive metadata

We pay by Stripe or PayPal, your choice, within 30 days of the fix shipping.

Coordinated disclosure

Please don't disclose a vulnerability publicly until we've shipped a fix. We'll keep you informed of progress and credit you in our release notes unless you'd rather stay anonymous.

Test only against your own accounts and vibes, don't access or change other people's data, and stop and report as soon as you find an issue.

What we don't claim

vibe-coded.ai is a small platform with one founder. We don't have a 24/7 incident response team or formal third-party audits (such as SOC 2 or ISO 27001). We do read every report, ship fixes promptly, tell you what we know, and pay for verified findings.