Security at FlexVibe

• Our pages and API work over HTTPS only, and browsers are told never to connect without it.
• Our database and file storage encrypt the data they store.
• Keys and credentials you give FlexVibe, such as your app's API keys, connector headers and tokens and your app's backend key, are stored with strong encryption: each new value gets its own data key, which is encrypted in turn with a master key kept outside the database. Each value is also tied to its workspace, so a copied value can't be decrypted anywhere else.
• Passwords are stored hashed, never in plain text.

• Sign in with an email and password, or with Google.
• Your sign-in session is kept in a secure cookie that is tied to our site and only travels over HTTPS.
• See your active sessions in Settings, and end any you don't recognize.
• Our API refuses changes that don't come from FlexVibe's own pages.
• Two-factor sign-in isn't available yet.

• Every project belongs to a workspace. On every request for a project, our servers check that you are a member of its workspace and that your role allows the action.
• The roles are Owner, Admin, Member and Viewer. Viewers can open projects and see their history, but can't run the agent or change apps.
• Teammates join a workspace by invitation, with the role an owner or admin chooses.
• Team settings show an activity log of invitations, role changes, removals and ownership transfers.
• When our own services call the agent, for example for WhatsApp or to delete a project, they use tokens that expire after 5 minutes and are limited to one user or one workspace.

• The code FlexVibe writes runs in a separate, isolated cloud environment for each project, not on the servers that run FlexVibe itself.
• These environments pause when they're idle.
• Each project's code is also kept in a private code repository that FlexVibe manages.

• If a message looks like it contains a secret key, such as an API key, FlexVibe doesn't send it and asks you to take the key out. The agent server runs the same check and refuses a request that contains one.
• Before the results of the agent's tools reach an AI model or the conversation history, we mask anything that looks like a secret key.
• When your app needs a key, the agent asks for it in a secure form: the value goes straight to an encrypted vault and is never shown again, and development and preview accept test keys only.
• Each time a stored key is saved, replaced, deleted or used, we record who did it and why, never the value.

• The agent doesn't stop to ask for your approval before it runs a command or a tool: it can search the web, use the services you connected and publish your app without a confirmation step. It still asks you for the keys your app needs, for answers to its questions and, in Plan mode, to approve the plan.
• Some commands are always refused, whatever the agent was told, such as force-pushing code, deleting anything outside your app, dropping database tables, publishing a package, using sudo or reading secret files.
• If someone in your project chose “Never allow” for a tool, it stays blocked. You can review and remove these choices in the project's Permissions.
• When the agent reads outside content, such as a web page or an uploaded file, we record it and mark the code it commits afterwards. Outside content can try to steer the agent, so check what it did after it read the web.
• We keep a record of each of the agent's actions that publishes, sends data out or reads a secret, with the person whose request started it.

• Published apps are hosted separately from the servers that run FlexVibe itself.
• A security check runs before publishing and can stop a release when it finds a critical problem.

• Our payment provider runs checkout and the billing portal. You enter card details on its pages, so card numbers never reach FlexVibe.
• We check the signature of every payment notification our payment provider sends us.

• Our pages are sent with standard security headers: HTTPS only, no embedding in other sites, and no guessing of content types.
• Our Content Security Policy is enforced on every page: your browser blocks scripts, frames and connections we haven't allowed, and reports the attempt to us.

We use a product analytics tool, with chat messages excluded and query strings removed from links. The Privacy policy has the details.

FlexVibe doesn't hold a formal security certification or an independent audit report yet. This page lists the controls in place today, and we'll update it when that changes.

If we find a security incident, we investigate it, contain it and fix its cause.

If it affects your personal data, we'll tell you, and the authorities where the law requires it, without undue delay.

• Email contact@flexvibe.dev with what you found, the steps to reproduce it and its impact.
• Test only with your own account and data. Don't access or change other people's data, and don't disrupt the service, for example with denial-of-service attacks, spam or social engineering.
• Give us reasonable time to fix the problem before you share it publicly. We'll confirm we received your report and keep you updated.
• If you follow these rules in good faith, we won't take legal action against you for your research.
• We don't run a paid bug bounty yet.