Security and responsible disclosure

How our free scan works

The free scan is passive. It only makes GET and HEAD requests and reads what any visitor's browser can already see: your pages, scripts, headers and public files. It never logs in, never submits forms and never tries attacks.

Deeper checks

We only run deeper checks, like testing whether a database table can be read without signing in, when the owner has given us permission or when someone is scanning their own app.

Invite us to test your app

Building something and want a closer look? Email hello@vibepatrol.dev with your app's address and what you'd like checked, and we'll agree on the scope with you first.

Found a problem in VibePatrol?

Please tell us at hello@vibepatrol.dev. Include what you found and how to reproduce it.

• We'll reply and keep you updated while we fix it.
• We won't take legal action against good-faith research that stays within the limits on this page.
• Please give us a reasonable amount of time to fix the problem before you share it publicly.

Out of scope

• Denial of service or anything that slows the site down for others
• Spam, including through our forms or emails
• Social engineering of our team or users
• Accessing, changing or deleting other users' data. If you see someone else's data by accident, stop and tell us.