Security notes.
Vibestrate is an open-source project maintained by its author - no company stands behind it, no business model, no support team. The source is public for anyone to inspect, audit, fork, or fix. If you find a security issue, the notes below describe how to share it. There are no service commitments and no warranty (see the Apache 2.0 license).
How to share a finding
- Private channel - preferred: open a private advisory at github.com/guyshonshon/vibestrate/security/advisories/new. GitHub Security Advisories give us a private tracker and a way to coordinate a fix before disclosure.
- Public channel: for non-sensitive issues you can also open a regular GitHub issue.
- Please don't share working exploits or sensitive details on social media, Discussions, or public issues before a fix lands.
We do not provide an email address for security reports. All contact happens on GitHub.
What helps
- A description of the issue and its real-world impact.
- Steps to reproduce - ideally a minimal proof of concept.
- Affected versions (commit hash if possible).
- Your GitHub handle if you'd like public credit.
No SLA, no commitments
Vibestrate is maintained on a best-effort basis by its author. Replies may come quickly, slowly, or not at all. There is no guaranteed acknowledgement time, no guaranteed fix window, and no bounty. If you need a guaranteed response, the practical route is to fork it and patch it yourself.
Scope
In scope:
- The Vibestrate orchestrator, CLI, and Mission Control web UI.
- This marketing site (vibestrate.com).
- Path-guard / sandbox escape, secret leakage, RCE, auth bypass.
Out of scope:
- Issues that require the attacker to already have local code execution on the user's machine.
- Vulnerabilities in third-party providers (Claude, Codex, Gemini, Ollama) - please report to the vendor.
- Self-XSS, missing security headers without a demonstrated impact, theoretical issues without a working exploit.
- Findings from automated scanners without manual verification.
Safe harbor (for researchers)
We will not pursue legal action against researchers who: (a) make a good-faith effort to follow these notes, (b) avoid privacy violations, data destruction, and service interruption, and (c) give us reasonable time to fix before disclosing publicly. Caveat: this is one person maintaining an open-source project. There is no legal team and no formal authority behind it, so this safe-harbor language is a good-faith statement, not a contract.
Use at your own risk
Vibestrate is provided "as is" with no warranties. Agents can write, modify, and delete files, execute commands in sandboxed worktrees, and spend tokens that cost real money with the vendors you connect. What you run, where you run it, what you authorize, and what it costs are your call.
