Vulnerability disclosure
Please do not open a public issue, pull request, or discussion for a vulnerability. Public disclosure before a fix is available puts users at risk.
Report privately to [email protected], or use GitHub's private report a vulnerability flow.
Include what the vulnerability is, what an attacker could do with it, the steps to reproduce it, the version you tested, and a suggested fix if you have one.
A machine-readable contact file is published at /.well-known/security.txt.
What you can expect
| Acknowledgement | Within 3 business days |
| Triage and an initial assessment | Within 7 business days |
| A fix or a mitigation plan | As soon as we understand the severity and the scope |
| Disclosure | Coordinated with you, after a fix ships. We will credit you if you want to be named. |
Safe harbor
Follow this policy in good faith and we will treat your research as authorized. We will work with you to fix the issue. We will not take legal action against you. If someone else brings a claim against you for work done under this policy, we will say plainly that you were authorized.
Good faith means four things:
- You do not read, change, or delete data that is not yours.
- You do not degrade the service for other people.
- You give us time to fix the problem before you tell anyone else.
- You stop and tell us the moment you find someone else's data.
Supported versions
The CLI is a rolling release. Security fixes land on the latest published version of @vibgrate/cli. Please reproduce on the latest release before reporting.
Vibgrate Cloud and Vibgrate Cloud MCP are hosted services. There is one version, and it is the current one.
How this relates to your code
Scanning is metadata-only, with the remediation-agent exception. A path that sends code or sensitive data off your machine without you asking, outside that exception, is a security issue. Report it here.