Security

1. Encryption

1.1 Encryption in transit

All traffic between your browser, our edge, and our origin is served exclusively over HTTPS using TLS 1.2 or higher. HTTP requests are redirected to HTTPS at the edge, and HSTS is enabled so compliant browsers refuse to fall back to plaintext.

1.2 Encryption at rest

Customer data is stored in Neon (managed PostgreSQL). Neon encrypts all data on disk using AES-256, and snapshots and backups inherit the same encryption. Application-level secrets (such as third-party API keys) are stored as encrypted environment variables and are never exposed in the client bundle.

2. Authentication & access control

2.1 Identity provider

User authentication is handled by Clerk. Vibeless never stores user passwords directly. Clerk provides industry-standard credential hashing, brute-force protection, breach detection, and session management out of the box.

2.2 Multi-factor authentication

MFA is supported for all user accounts via Clerk, including TOTP authenticator apps and SMS. We strongly recommend customers enable MFA, and we plan to make it a requirement for Team and Enterprise tiers in a future release.

2.3 Session management

Sessions use short-lived, signed tokens issued by Clerk. Cookies are set with the HttpOnly, Secure, and SameSiteattributes. Sessions can be revoked from the user's account settings, and stale sessions expire automatically.

2.4 Administrative access

Access to Vibeless admin tooling is gated behind a separate, allow-listed admin user table and requires a one-time password (OTP) delivered to a registered admin email on every sign-in. Admin actions are written to an immutable audit log that records actor, action, target, and source IP.

Admin one-time codes are emailed via SendGrid; we configure the lowest available retention on our email provider to limit exposure of expired codes.

3. Application security

3.1 Hardened HTTP response headers

• Content-Security-Policy (CSP): a strict policy limits scripts, styles, frames, and connect targets to known first-party and trusted third-party origins.
• Strict-Transport-Security (HSTS): set with a long max-age and includeSubDomains so browsers always upgrade to HTTPS.
• X-Frame-Options & frame-ancestors: set to deny by default to mitigate clickjacking.
• X-Content-Type-Options: nosniff to prevent MIME confusion attacks.
• Referrer-Policy: strict-origin-when-cross-origin to limit referrer leakage to third parties.

3.2 Defensive coding standards

• All database access goes through Prisma with parameterised queries; raw SQL is reviewed and limited to the few cases that cannot be expressed declaratively.
• Inputs to mutating API routes are validated and length-bounded before any side effects.
• Output that may contain user-supplied content (such as the contact-form forwarding email) is HTML-escaped before being inserted into HTML or email bodies.
• Public mutating endpoints are rate-limited per IP using a shared sliding-window limiter to mitigate abuse.
• Dependencies are kept current and reviewed during release; we respond to high-severity advisories on a priority basis.

4. Vulnerability disclosure

If you believe you have found a security vulnerability in any Vibeless product or service, please email security@vibeless.pro with a description of the issue, a clear reproduction, and any supporting material (screenshots, logs, proof-of-concept).

We aim to acknowledge new reports within 72 hours (aspirational SLA) and to keep you updated on remediation progress through resolution. We do not currently operate a paid bug-bounty program, but we are happy to publicly acknowledge researchers who responsibly disclose valid issues.

Please test only against accounts you own, do not access or modify other users' data, do not perform denial-of-service testing, and give us a reasonable opportunity to fix the issue before disclosing it publicly.

5. Sub-processors

Vibeless engages the following sub-processors to operate the Service. Each is contractually bound to security and data-protection terms equivalent to those we provide our customers.

We provide at least 30 days' advance notice of new sub-processors via this page and via email to account-administrator contacts on Team and Enterprise plans.

6. Contact

For security questions, vulnerability reports, or compliance documentation requests, email security@vibeless.pro.