Security & Threat Model

1. What Leaves Your Machine

The core security promise of VibeShield is absolute data containment:

• Zero Egress on Every Surface: The CLI binary, the npm launcher, the pre-commit hook, and the IDE integrations execute rule matching exclusively in local memory. There is no telemetry, no cloud logging, no user tracking, and no external code transfer.
• No Backend Server: VibeShield maintains no centralized SaaS backend, databases, or cloud infrastructure. The compiled Go binary contains zero HTTP networking client code for code egress.
• CI/CD Runner Isolation: In GitHub Action mode, the action runs entirely inside your self-hosted or GitHub-hosted runner. It communicates only with GitHub's official API using your repository's native GITHUB_TOKEN to post findings directly to the pull request.
• No AI Model Training: Because your source code and prompts are never collected or stored, nothing is ever used for model training or fine-tuning.

2. Trust Boundaries & Execution Isolation

The table below details where each component runs, what data it accesses, and its network posture:

3. How the Scanner Reads Your Code

• Read-Only Access: The scanner never modifies your source files during scan. Automated remediation via fix requires explicit interactive confirmation or preview.
• No Execution of Scanned Code: Scanned files are treated strictly as text and AST trees; VibeShield never executes, builds, or runs tests on the inspected code.
• Automatic Secret Redaction: When a suspected secret (such as an API token or private key) is detected in a diff, the finding redacts all but four prefix and suffix characters before outputting to terminal or PR comments.

4. Coordinated Vulnerability Disclosure

If you discover a security vulnerability or bypass in VibeShield, we ask that you report it responsibly and coordinate disclosure with us before public release.

How to Report

• Preferred Method: Open a private security report via GitHub Security Advisories. This provides an encrypted, private channel accessible only to maintainers.
• Direct Security Email: Alternatively, contact our security team at security@vibeshield.dev.
• Security.txt: Machine-readable disclosure information is published at /.well-known/security.txt in compliance with RFC 9116.

Response Targets

We provide public attribution in our release notes and changelog for security researchers who report in good faith.

5. Detection Precision & Benchmark Integrity

Security scanners are only useful if developers trust their output without fatigue. Our release criteria mandate:

• ≥ 85% precision on Critical and High severity findings evaluated against our curated golden test suite.
• ≤ 5 false positives per 1,000 scanned diff lines.
• Auditable dismiss rationale requiring developer justification when dismissing rule findings.