Data handling

Most scanners ask you to upload the repository. Vibgrate's scan does not.

The Vibgrate CLI reads manifests and lockfiles on your machine. If you send a scan, the payload is package names, versions, findings, and a score. The payload is checked against a closed schema when it arrives. Anything not on the schema is rejected. Your source code stays on your machine for that path.

The CLI runs locally and offline by default. The code graph needs no API key and makes no network calls. The local MCP server exposes read-only tools.

The exception you choose

The remediation agent is different. When you ask it to write a fix, it clones the repository into an isolated virtual machine we operate, makes the change, and hands you a pull request. It runs only when you ask. That is the only path on which source code is processed off your machine.

Security is the longer page, including what a normal scan receives and what it does not. Subprocessors names who is in each path.

Language models and your data

A normal scan does not send your source code to a language-model provider.

The remediation agent can. When you ask it to write a fix, the repository is cloned into a virtual machine we operate, and the model configured for that run can see the repository context that fix needs. Hosted models in that catalogue are served by OpenAI, Anthropic, Google, and DeepSeek. A local model runs on the virtual machine and does not send the repository to those companies.

Scan analysis can send source-derived input to OpenAI. OpenAI is on the subprocessor list, with Amazon Web Services for the virtual machine. Anthropic, Google, and DeepSeek are on that list for a remediation run that uses them.

What we will not add here

We do not publish a residency guarantee, an uptime figure, or a list of internal review items. SSL Labs reports TLS 1.2 and TLS 1.3 for vibgrate.com, grade A. Releases are signed; the check commands are on Signed releases. The Observatory and SSL Labs links are on Security overview.