Security
Security, plainly
What keeps your app, its data and the platform safe, and how. In plain words wherever we can.
Builds
Every build in a box of its own
A sandbox for every build
Each build runs on a throwaway machine of its own. It can reach only npm (to read packages), the app's own repository and its own database. Everything else is blocked, so code the agent writes can't send what it finds anywhere.
The push token stays out
The sandbox can read the app's code but never holds a token that can change it: the push is made from outside it.
Secrets don't get pushed
A change that holds one of the build's secrets is refused. The sandbox gets a throwaway owner key of its own, never your app's real one.
Packages, checked
Packages come only from npm's registry and install without running their scripts. A step that adds one with a high or critical known advisory doesn't pass its checks.
Apps
Apps on a domain of their own
A domain of their own
Apps live on vible.tech, Vible on vible.dev. An app's code can't set cookies for Vible or reach your session there.
Cookies kept to the app
App cookies are __Host- (kept to that exact address), HttpOnly (out of reach of scripts) and count only on requests from the app's own pages. Other cookie code is refused before it is pushed.
Your side, without passwords
Opening your app from Vible signs you in to what only you may see or change. The key is kept in an HttpOnly cookie and checked on the server; anyone else is refused.
The platform
Vible itself, kept locked down
HTTPS, always
Vible is served with HSTS and a strict content security policy: scripts come only from Vible itself, and other sites can't frame it.
Secrets stay server-side
AI and hosting keys stay on Vible's servers: never in your browser, never in a build.
Links read elsewhere
Links you share are opened in a browser on a sandbox of its own, never on Vible's servers, so a link can't reach anything of the platform's.
Verified sign-up
An email is confirmed before its account can sign in. Sign-up and sign-in attempts are rate limited.
Deleting is complete
Deleting a project deletes its build sandbox, database, hosting, code and conversation.
Tell Vible what you need
A sentence or two is enough. You'll be asked the rest.