Security
In short: we hold ourselves to the same standard we review your app against. If you find a vulnerability in Safe2Vibe, email security@safe2vibe.com. We won't take legal action against good-faith research that follows this policy.
How we protect your data
Infrastructure
- The Site and Service run on established cloud providers with recognized security programs. See Subprocessors.
- All traffic uses HTTPS. The Site enforces HTTPS with HSTS and sends security headers that block framing, content-type sniffing and loading content from unexpected domains.
- Data is encrypted at rest by our database provider.
- The Site loads no third-party trackers, analytics or advertising scripts.
Database
- Every table that can receive data from the Site has Row Level Security enabled.
- The public key used in the browser can only add entries to the waitlist. It cannot read, change or delete anything. We test this ourselves.
- Administrative access uses separate credentials that are never exposed in client code.
Access to customer apps
- We request read-only access, limited to what a review needs.
- Tests behind the login use test accounts you create, never your real users.
- We don't run destructive tests, denial-of-service tests or social engineering.
- Reviewers sign confidentiality agreements, only see projects assigned to them, and work inside the Service.
- When you disconnect an app, we revoke our access and delete its review data according to our Privacy Policy.
People and process
- Access to production systems is limited to people who need it, with multi-factor authentication.
- We review our own code and configuration with the same standard we use for customers.
- If we confirm a security incident affecting your personal data, we will notify you without undue delay, and customers as described in our Data Processing Addendum.
Responsible disclosure
We welcome reports from security researchers. If you believe you've found a vulnerability in safe2vibe.com or the Safe2Vibe Service, please tell us.
How to report
Email security@safe2vibe.com with:
- a description of the issue and its impact,
- the steps to reproduce it,
- any proof of concept, screenshots or logs,
- how you'd like to be credited, if at all.
We'll acknowledge your report within 3 business days, keep you updated, and tell you when it's fixed.
In scope
- safe2vibe.com and its subdomains
- The Safe2Vibe Service, once launched
Out of scope
- Apps built or owned by our customers. Report those to their owners.
- Third-party services we use, such as our hosting or database providers. Report those to the provider.
- Findings without a security impact, such as missing best-practice headers on non-sensitive pages, clickjacking on pages with no sensitive actions, or version disclosure alone.
- Denial-of-service, spam, social engineering or physical attacks.
Rules of engagement
- Don't access, change or delete data that isn't yours. Use only accounts you create.
- Don't degrade the service for others, and don't use automated scanners at high volume.
- Stop and report as soon as you've confirmed an issue. Don't pivot to other systems.
- Give us reasonable time to fix the issue before disclosing it publicly. We aim to fix critical issues within 30 days and will agree on a disclosure date with you.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized, we won't pursue legal action against you, and we won't report you to the authorities for it. If a third party takes action against you for research that followed this policy, we will make it known that your actions were authorized by us.
We don't currently run a paid bug bounty, but we will publicly thank researchers who help us, with their permission.
Our machine-readable contact details are at /.well-known/security.txt.