Responsible Use

Authorization required

You may only scan a URL you own, or one you have explicit written permission to test. Every scan launched from VibeSafely — web UI or public API — requires an authorization acknowledgement. Scans without one are refused.

Scanning a third-party site without permission may violate the Computer Fraud and Abuse Act (US), the Computer Misuse Act (UK), equivalent statutes worldwide, and our Terms of Service.

What we probe

• HTTP response headers on the target URL and same-origin sub-paths.
• Well-known paths that should not be public: /.env, /.git/config, /.git/HEAD, common backup files, exposed source maps.
• Public JavaScript bundles linked from the page, for accidental secrets and misconfiguration.
• Publicly reachable auth flows and cookie flags.
• CORS and Content-Security-Policy configuration.
• On Deep scans: same-origin BFS crawl up to a bounded page count.

What we do NOT do

• We do not attempt to write, update, or delete data through your API.
• We do not submit real-looking payloads to forms that create user records.
• We do not brute-force credentials, session tokens, or password-reset flows.
• We do not attempt SQL injection with destructive payloads. Where we test injection we use safe, non-destructive canaries.
• We do not exceed low request rates. Scans are polite (~1–2 req/sec typical).
• We do not persist raw secrets. Any secret detected is truncated to last-4 characters before storage.

Data handling

Scan results live in your account. Attacker-sensitive evidence (full secrets, complete credential material) is never stored in full — only redacted or truncated proof. You can delete any scan at any time, and account deletion removes every associated record.

Report a problem

If VibeSafely misbehaves against your site — unexpected traffic, excessive rate, or scan output that reveals more than it should — email security@vibesafely.app and we will investigate immediately.