Security

VibeHost operates within GNTC Inc.'s ISO/IEC 27001 information security management system. VibeHost runs on Google Cloud for the control plane (API, dashboard, database, cache) and on Cloudflare for edge delivery and object storage. That infrastructure is independently certified under the standards published by those providers (including ISO 27001 family, SOC, and PCI DSS). Certification documentation is available to enterprise customers on request.

Every deploy is a tarball upload, and unpacking is not trusted by default. The unpack path and the chunked blob-assembly path both reject absolute paths, .. traversal, disallowed symlinks, any entry over the per-file size ceiling, a total archive over the archive ceiling, and archives over the entry-count limit. Each guard is enforced in code and covered by a test. A tarball that violates any of them is rejected before anything is written to disk.

For static sites, any build step runs on your machine and the server only accepts the finished files. Next.js and Node apps build on our side by default. The build runs in a Builder Job under gVisor, which gives it its own kernel in user space, so build code never talks to the host kernel directly. The API then uploads the build output to Cloudflare, and for Next.js apps it runs Wrangler to do so. Static files are served from Cloudflare R2. Apps that need a server, such as Next.js with SSR, run on Cloudflare Workers for Platforms.

A viewer gets into an app when its visibility lets them in, when they hold a grant on that app, or when they open a valid share link. Visibility is public, workspace or private. Grants go to a team or an email address, at viewer, deployer or admin level. If the app has a password, every viewer has to enter it, whichever way they came in, share links included.

API tokens are never stored in plaintext: only a SHA-256 hash is persisted, and the plaintext is returned exactly once at issuance. Tokens are never written to logs. The CLI stores its token in a user-owned config file with restricted file permissions. Infrastructure secrets are kept out of the repository entirely.

Administrative actions are recorded to an audit log for incident analysis and accountability. Access logs (IP, request path, timestamp) are retained for 90 days for abuse prevention and billing. Dependencies are continuously scanned for known vulnerabilities and license issues in CI, and every change goes through code review before it can merge.

If you believe you have found a security issue in VibeHost, please report it privately so we can investigate and fix it before any public disclosure. Do not include credentials, tokens, or third-party personal data in your report.

We aim to acknowledge a report within 5 business days and will keep you updated on remediation progress. We ask that you give us a reasonable window to ship a fix before disclosing publicly.