Skip to content

Before you submit anything

What happens to your app

You are about to let software you did not write open an application you did. That is a reasonable thing to be careful about. This page is the mechanism, in order, with the limits stated as what the code cannot do rather than as what we promise not to.

We never see your code

There is nowhere to give it to us. No repository access, no upload, no integration that reads your files. VibefyCode opens the address you gave us in a browser and looks at what a visitor would see — the pages that render, the requests they make, the headers that come back. If your source is not published on the internet, we have not read it.

This is a fact about the shape of the product rather than a policy. There is no code path that could read a repository, because nothing in this system has ever been given one.

The five steps, and what we can see at each

Nothing skips ahead. Each step waits for the one before it, and the first two happen before anything touches your application at all.

  1. 01

    You describe the application

    A name and an address. That is the whole form.

    What we can see: Nothing yet. No request has been made to your app.

  2. 02

    You prove you control it

    Publish a DNS record, or put a small text file at a known path on your own site. Then press Verify.

    What we can see: One request, to that one file, to read one token. Nothing is assessed and nothing is stored about your application beyond the fact that the check passed.

  3. 03

    You set the boundary

    Which hosts are in scope, which paths are excluded, and how hard the run may push. Exclusions always win over inclusions.

    What we can see: Still nothing. This is you writing the rules the next step is held to.

  4. 04

    The assessment runs

    Inside the boundary you set, under the ceiling below. It stops at 30 minutes whatever else is true — a run that has not finished by then is a run that has found what it is going to find.

    What we can see: Your public pages, the requests they make, and anything a synthetic test account can reach. Every observation is captured as evidence, and the evidence is yours to read.

  5. 05

    A person reviews it

    A VibefyCode reviewer checks every finding against its evidence and withholds any the evidence does not support. Usually within one working day.

    What we can see: The same evidence you can see. Nothing is published before this step.

The ceiling your app is protected by

These are read from the scope guard itself, not written out here. A run that tries to exceed one of them is stopped by the code rather than reported afterwards.

240Requests per minute, at most
12,000Requests in the whole run
30 minLongest a run may last

That is roughly 4.0 requests a second — slower than one person clicking quickly, and far below anything that would trouble a server. If your application is small enough that this still worries you, say so when you set the boundary and the ceiling comes down.

What it is unable to do

Not a list of things we choose not to do. A list of things the runner refuses, at the moment it opens the connection.

  • Change or delete anything

    DELETE, PUT and PATCH are never sent. Data modification is off, and the run is non-destructive by construction — a stage that tried would be stopped before the request left.

  • Touch a host you did not authorise

    The address is checked after it resolves, not just as text. A hostname that points somewhere else — including at an internal address — is refused at connect time, which closes the window a check on the URL alone would leave open.

  • Use your real accounts

    Synthetic test accounts only. We never ask for, accept or store a real user credential, and there is no field in which to give us one.

  • Export your data

    Data export is off. The run reads what a page shows; it does not pull records out of your application.

  • Keep running after you say stop

    Withdrawing authorisation stops the run. Nothing claims new work for an application whose authorisation is no longer live.

  • Spend without a limit

    A global spending cap is checked before any run is claimed. It is a row in the database rather than state in a process, so restarting the runner does not lift it.

What is kept, and for how long

Evidence is what makes a finding checkable rather than an opinion, so it is kept — and then it is deleted, on a clock set when it is captured rather than when somebody remembers.

Evidence kinds and how many days each is retained
Kind of evidenceKept for
screenshot30 days
playwright trace30 days
dom snapshot30 days
console log60 days
http exchange90 days
header scan90 days
dependency report90 days
lighthouse report90 days
accessibility scan90 days

Screenshots and traces are held for the shortest time, because they are where something incidental is most likely to have been captured. Credentials are scrubbed at capture rather than before publication — an artefact that has to be remembered about later is an artefact that eventually gets published unsanitised.

And what this is not

An assessment is point-in-time and scope-limited. It is not a penetration test, a security audit, a code audit, a legal or regulatory certification, or a guarantee of any kind. It does not certify that an application is free of defects, lawful, or fit for any particular purpose. Absence of a finding is not evidence that nothing is there — it means we did not find it within the boundary you set.

Create an accountHow the score is worked outThe terms, in full