What we deliberately never hold
- A key to your source code. When you let us read your code, you do it on GitHub's own screen, for the repositories you pick. We store only the number of that permission grant. Each time a test needs the code, we ask GitHub for a short-lived, read-only pass for that one repository, and it expires within the hour. There is no long-lived token anywhere in our database to steal.
- Your card details. Payment goes through Stripe. We never see the card number.
- Your sign-in password. Signing in is handled by a separate sign-in service. Your browser gets one session cookie that scripts on a page cannot read, and we store only a scrambled fingerprint of it.
- A copy of any key we find in your code. If a test finds a leaked password or key, the report shows where it is, never the value. A report that repeated the key would be a second leak.
What we do hold, and how
- The password to your own site, if you give us one so the deep test can sign in. It is stored encrypted with a key that lives only on our servers, and the screen only ever shows that a password is set, never the password.
- Your source code, briefly. It is copied into temporary storage for the length of the stage that reads it and deleted when that stage finishes.
- Your reports. Kept so you can compare runs over time. Deep test reports are visible only to you when signed in.
How the deep test is kept in bounds
The deep test sends real attack traffic at your site, so it is fenced on every side:
- It runs only on the site attached to your subscription, after you have confirmed you own it. Nothing in a request can point it somewhere else.
- It never leaves your site. Links that lead elsewhere are not followed.
- Nothing destructive. It probes for weaknesses; it does not delete, change or fill your data.
- A fixed time budget, and no automatic retry. A retry would be another half hour of attack traffic you did not ask for.
- Trying whether a leaked key still works is a separate box you tick per run, because it signs in to your other accounts and shows up in their logs.
- Neither the free check nor the deep test will run against private or internal addresses.
Where things live
Everything runs on servers in Germany. Connections to the site, to the sign-in service and between our own parts are encrypted. Staff tooling is a separate application with its own sign-in, and self-registration on it is switched off.
Reporting a problem with us
If you find a weakness in vibeship.eu, email support@vibeship.eu. We will confirm within one business day and tell you what we did. Please do not access other customers' data, and do not try to disrupt the service. We will not take action against anyone who reports in good faith and stays within those lines.