Security notes.
Vibestrate is an open-source educational project - no company stands behind it, no business model, no support team. The source is public for anyone to inspect, audit, fork, or fix. If you find a security issue, the notes below describe how to share it. There are no service commitments and no warranty (see the Apache 2.0 license).
How to share a finding
- Private channel - preferred: open a private advisory at github.com/guyshonshon/vibestrate/security/advisories/new. GitHub Security Advisories give us a private tracker and a way to coordinate a fix before disclosure.
- Public channel: for non-sensitive issues you can also open a regular GitHub issue.
- Please don't share working exploits or sensitive details on social media, Discussions, or public issues before a fix lands.
We do not provide an email address for security reports. All contact happens on GitHub.
What helps
- A description of the issue and its real-world impact.
- Steps to reproduce - ideally a minimal proof of concept.
- Affected versions (commit hash if possible).
- Your GitHub handle if you'd like public credit.
No SLA, no commitments
Vibestrate is maintained on a best-effort basis by a tiny set of volunteers. We may respond quickly, slowly, or not at all. There is no guaranteed acknowledgement time, no guaranteed fix window, and no bounty. If you need a guaranteed response, this is not the project for you - fork it and patch it.
Scope
In scope:
- The Vibestrate daemon, CLI, and Mission Control web UI.
- This marketing site (vibestrate.com).
- Path-guard / sandbox escape, secret leakage, RCE, auth bypass.
Out of scope:
- Issues that require the attacker to already have local code execution on the user's machine.
- Vulnerabilities in third-party providers (Claude, Codex, Gemini, Ollama) - please report to the vendor.
- Self-XSS, missing security headers without a demonstrated impact, theoretical issues without a working exploit.
- Findings from automated scanners without manual verification.
Safe harbor (for researchers)
We will not pursue legal action against researchers who: (a) make a good-faith effort to follow these notes, (b) avoid privacy violations, data destruction, and service interruption, and (c) give us reasonable time to fix before disclosing publicly. Caveat: we are a tiny volunteer project - we have no legal team, no lawyers, and no formal authority. This safe-harbor language is a good-faith statement, not a contract.
Use at your own risk
Vibestrate is provided "as is" with no warranties. Running multi-agent orchestration on your code is inherently powerful - agents can write, modify, and delete files, execute commands in sandboxed worktrees, and consume tokens that cost real money on the vendors you connect. You are responsible for what you run, where you run it, what you authorize, and what it costs. We provide the tool; you provide the judgment.
