[{"data":1,"prerenderedAt":1169},["ShallowReactive",2],{"security":3},{"id":4,"title":5,"author":6,"authorImage":6,"authorTitle":6,"body":7,"category":6,"date":6,"description":1162,"extension":1163,"image":6,"meta":1164,"navigation":1165,"path":1166,"readTime":6,"seo":1167,"stem":13,"__hash__":1168},"content/security.md","Security",null,{"type":8,"value":9,"toc":1114},"minimark",[10,14,22,25,34,39,44,66,70,73,99,105,109,113,118,140,145,159,163,168,176,183,188,203,207,210,215,226,230,234,239,254,259,272,277,292,296,301,312,317,328,333,344,351,355,360,370,375,381,385,389,394,408,411,416,421,429,432,436,441,455,462,467,478,482,487,501,511,516,533,537,542,556,561,582,586,590,595,603,606,611,620,624,632,640,645,653,657,660,674,679,693,697,701,706,720,725,740,744,749,757,760,765,773,776,780,783,803,807,812,823,827,830,861,865,868,882,886,889,893,907,910,915,920,924,928,931,936,962,966,972,1000,1004,1007,1021,1025,1032,1058,1062,1065,1097,1103,1106,1111],[11,12,5],"h1",{"id":13},"security",[15,16,17,21],"p",{},[18,19,20],"strong",{},"Last Updated:"," August 19, 2026",[15,23,24],{},"You're trusting us with your data, so this page tries to be genuinely useful rather than reassuring. It describes what we actually run today — and, just as explicitly, what we don't. Where a control isn't in place, you'll find it said plainly instead of dressed up.",[15,26,27,28,33],{},"We're a small team building in the open. If a control you need is missing, email ",[29,30,32],"a",{"href":31},"mailto:security@vibedasher.com","security@vibedasher.com"," and ask; we'll give you a straight answer.",[35,36,38],"h2",{"id":37},"security-overview","Security Overview",[40,41,43],"h3",{"id":42},"our-commitment","Our Commitment",[45,46,47,54,60],"ul",{},[48,49,50,53],"li",{},[18,51,52],{},"Security First",": Security is a core principle in all design and development decisions",[48,55,56,59],{},[18,57,58],{},"Transparency",": We're open about our security practices — including the parts we haven't built yet. Where this page says we don't do something, that's deliberate; we'd rather you know.",[48,61,62,65],{},[18,63,64],{},"Continuous Improvement",": We keep tightening this as we grow",[40,67,69],{"id":68},"certifications-and-compliance","Certifications and Compliance",[15,71,72],{},"We hold no third-party security certifications of our own today. We'd rather say that plainly than imply otherwise.",[45,74,75,81,87,93],{},[48,76,77,80],{},[18,78,79],{},"ISO 27001"," (planned for 2026): Information security management certification",[48,82,83,86],{},[18,84,85],{},"SOC 2 Type II"," (planned): we have not yet completed a SOC 2 audit, and we will not claim the certification until a report exists",[48,88,89,92],{},[18,90,91],{},"GDPR",": we build to the EU data protection regime — data export, deletion, portability, and the breach-notification duty described below",[48,94,95,98],{},[18,96,97],{},"CCPA",": we build to the California Consumer Privacy Act's access and deletion rights",[15,100,101,102,104],{},"If your procurement process requires a completed audit report today, contact us at ",[29,103,32],{"href":31}," and we'll tell you exactly where we stand rather than send you a certificate we don't have.",[35,106,108],{"id":107},"infrastructure-security","Infrastructure Security",[40,110,112],{"id":111},"cloud-architecture","Cloud Architecture",[15,114,115],{},[18,116,117],{},"Multi-Region Deployment:",[45,119,120,132],{},[48,121,122,123,127,128,131],{},"We run in AWS ",[124,125,126],"code",{},"us-east-1"," (North America) and ",[124,129,130],{},"eu-central-1"," (Europe). We do not currently operate an Asia-Pacific region.",[48,133,134,135,139],{},"Talk to us at ",[29,136,138],{"href":137},"mailto:support@vibedasher.com","support@vibedasher.com"," if you have a data-residency requirement — we'll tell you what we can serve today.",[15,141,142],{},[18,143,144],{},"Infrastructure Providers:",[45,146,147,153],{},[48,148,149,152],{},[18,150,151],{},"Primary",": AWS (Amazon Web Services)",[48,154,155,156],{},"AWS maintains extensive security certifications of its own (SOC 2, ISO 27001, FedRAMP, etc.). ",[18,157,158],{},"Those are AWS's certifications for the infrastructure we rent — they are not Vibedasher certifications and do not transfer to us.",[40,160,162],{"id":161},"network-security","Network Security",[15,164,165],{},[18,166,167],{},"Perimeter Protection:",[45,169,170,173],{},[48,171,172],{},"All public traffic terminates at AWS API Gateway and CloudFront, which absorb the network-layer DDoS protection AWS provides by default",[48,174,175],{},"Authenticated request authorization at the edge",[15,177,178,179,182],{},"We do ",[18,180,181],{},"not"," currently run a Web Application Firewall (WAF) or an intrusion detection/prevention system (IDS/IPS). Those are on the roadmap, not in production.",[15,184,185],{},[18,186,187],{},"Network Segmentation:",[45,189,190,197,200],{},[48,191,192,193,196],{},"Untrusted, user-generated code runs in an isolated VPC with ",[18,194,195],{},"no internet route at all"," — no internet gateway, no NAT, egress only to AWS storage endpoints",[48,198,199],{},"Most compute runs as AWS Lambda functions with narrowly scoped IAM roles rather than long-lived servers",[48,201,202],{},"Our SQL worker instances do have outbound internet access, because they need to reach the customer databases you connect",[40,204,206],{"id":205},"server-security","Server Security",[15,208,209],{},"We run serverless (AWS Lambda) rather than managing our own fleet, so most host-level hardening is AWS's responsibility under the shared-responsibility model. We do not operate Kubernetes.",[15,211,212],{},[18,213,214],{},"What we own:",[45,216,217,220,223],{},[48,218,219],{},"Minimal dependency surface in every deployed function",[48,221,222],{},"Least-privilege IAM per function",[48,224,225],{},"Dependency updates as part of normal development",[35,227,229],{"id":228},"data-security","Data Security",[40,231,233],{"id":232},"encryption","Encryption",[15,235,236],{},[18,237,238],{},"Data in Transit:",[45,240,241,244,247],{},[48,242,243],{},"HTTPS everywhere. TLS 1.2 is the enforced minimum on our CDN and API edge; TLS 1.3 is supported and negotiated by default with modern clients",[48,245,246],{},"Modern cipher suites with Perfect Forward Secrecy, per the AWS TLS security policies we pin",[48,248,249,250,253],{},"HTTP Strict Transport Security (HSTS) with a one-year max-age, ",[124,251,252],{},"includeSubDomains",", and preload on our marketing site. The application itself does not yet send HSTS — that's a gap we're closing.",[15,255,256],{},[18,257,258],{},"Data at Rest:",[45,260,261,264],{},[48,262,263],{},"AES-256 server-side encryption on our primary object-storage bucket, explicitly configured",[48,265,266,267,271],{},"DynamoDB tables are encrypted at rest by AWS default. Not every table has encryption ",[268,269,270],"em",{},"explicitly"," pinned in our infrastructure code, and we're tightening that.",[15,273,274],{},[18,275,276],{},"Key Management:",[45,278,279,282,285],{},[48,280,281],{},"Encryption keys are AWS-managed. We do not currently operate customer-managed KMS keys, per-customer key separation, or a Hardware Security Module — data is separated by account at the application layer, not by distinct encryption keys.",[48,283,284],{},"Application secrets live in AWS SSM Parameter Store. No keys or credentials are stored in application code or version control.",[48,286,287,288,291],{},"Our ES256 JWT signing keys ",[18,289,290],{},"are"," rotated automatically, on a 30-day lifetime with a 7-day grace period.",[40,293,295],{"id":294},"database-security","Database Security",[15,297,298],{},[18,299,300],{},"Access Controls:",[45,302,303,306,309],{},[48,304,305],{},"Principle of least privilege",[48,307,308],{},"Service-specific database users",[48,310,311],{},"We run no self-managed database servers — our primary datastore is AWS-managed DynamoDB, reachable only via authenticated AWS APIs, never over the public internet",[15,313,314],{},[18,315,316],{},"Database Hardening:",[45,318,319,322,325],{},[48,320,321],{},"Encrypted connections required",[48,323,324],{},"Strong authentication (no default passwords)",[48,326,327],{},"Encrypted backups",[15,329,330],{},[18,331,332],{},"Query Security:",[45,334,335,338,341],{},[48,336,337],{},"Parameterized queries to prevent SQL injection",[48,339,340],{},"Input validation and sanitization",[48,342,343],{},"Query timeouts to prevent resource exhaustion",[15,345,346,347,350],{},"We do not currently force connections to ",[268,348,349],{},"your"," databases to be read-only at the driver level. When you connect a data source, grant Vibedasher a read-only database user — that's the boundary we recommend, and it's yours to set.",[40,352,354],{"id":353},"backup-and-recovery","Backup and Recovery",[15,356,357],{},[18,358,359],{},"Backup Strategy:",[45,361,362,365],{},[48,363,364],{},"Point-in-time recovery is enabled on our primary DynamoDB tables, giving a rolling 35-day restore window",[48,366,178,367,369],{},[18,368,181],{}," run a separate scheduled backup job, and object-storage versioning is off. PITR on our main tables is the recovery mechanism — that's the whole of it.",[15,371,372],{},[18,373,374],{},"Disaster Recovery:",[15,376,377,378,380],{},"We have not published a Recovery Point Objective or Recovery Time Objective, and we do not currently run scheduled disaster-recovery drills. Stating a number we haven't tested would be worse than saying so. If a contractual RPO/RTO matters to you, contact ",[29,379,32],{"href":31}," and we'll have the real conversation.",[35,382,384],{"id":383},"application-security","Application Security",[40,386,388],{"id":387},"secure-development-lifecycle","Secure Development Lifecycle",[15,390,391],{},[18,392,393],{},"Code Security:",[45,395,396,399,402,405],{},[48,397,398],{},"Every change is code-reviewed before it ships",[48,400,401],{},"A test, lint and contract-freshness gate runs locally and on a pre-push hook before code reaches production",[48,403,404],{},"Container images are scanned on push",[48,406,407],{},"Secrets are kept out of the repository and injected from AWS SSM Parameter Store at runtime",[15,409,410],{},"To be precise about it: our hosted CI does not currently run the test suite on every push — the gate is enforced before push instead.",[15,412,178,413,415],{},[18,414,181],{}," currently run dedicated SAST, DAST, or Software Composition Analysis tooling. Those are roadmap items.",[15,417,418],{},[18,419,420],{},"Development Practices:",[45,422,423,426],{},[48,424,425],{},"Secure coding guidelines and an architecture-invariants document the team works against",[48,427,428],{},"Least-privilege IAM for every deployed component",[15,430,431],{},"Vibedasher is a small team; we do not run a formal security training program, a security champions program, or a standing threat-modeling process.",[40,433,435],{"id":434},"authentication-and-authorization","Authentication and Authorization",[15,437,438],{},[18,439,440],{},"Authentication:",[45,442,443,446,452],{},[48,444,445],{},"Passwords must be at least 8 characters, with mixed case, a digit and a symbol",[48,447,448,449],{},"OAuth 2.0 sign-in with ",[18,450,451],{},"Google and LinkedIn",[48,453,454],{},"Signed session tokens (ES256, verified against a rotating JWKS) with expiry",[15,456,457,458,461],{},"Multi-factor authentication and SAML 2.0 single sign-on are ",[18,459,460],{},"not available yet",". If SSO is a blocker for your organisation, tell us — it moves up the roadmap when customers ask.",[15,463,464],{},[18,465,466],{},"Authorization:",[45,468,469,472,475],{},[48,470,471],{},"Role-Based Access Control, with groups and per-object access rights",[48,473,474],{},"Granular permissions (view, edit, create, delete, share)",[48,476,477],{},"Account and workspace isolation enforced server-side on every request",[40,479,481],{"id":480},"api-security","API Security",[15,483,484],{},[18,485,486],{},"API Protection:",[45,488,489,492,495,498],{},[48,490,491],{},"API key authentication, with 256-bit tokens, expiry, and revocation",[48,493,494],{},"Short-lived JWTs (ES256, ~15 minute expiry) verified against a rotating JWKS",[48,496,497],{},"Service-wide request throttling at the API edge",[48,499,500],{},"API versioning for backward compatibility",[15,502,503,506,507,510],{},[18,504,505],{},"Per-key"," rate limiting and IP allow-listing are not available today — the throttle above is service-wide, not per customer. Embed keys carry a domain allow-list, which is ",[18,508,509],{},"empty (allow-all) by default"," — set it if you use embeds.",[15,512,513],{},[18,514,515],{},"Input Validation:",[45,517,518,521,524,527],{},[48,519,520],{},"Pydantic schema validation and strict typing on every request body",[48,522,523],{},"Parameterized queries throughout",[48,525,526],{},"Size limits to prevent resource exhaustion",[48,528,529,532],{},[124,530,531],{},"Content-Security-Policy: frame-ancestors"," on embed responses to control which origins may frame a dashboard",[40,534,536],{"id":535},"ai-security","AI Security",[15,538,539],{},[18,540,541],{},"Prompt Injection Protection:",[45,543,544,547,550,553],{},[48,545,546],{},"Input sanitization for AI prompts",[48,548,549],{},"Context length limits, with automatic compaction of long conversations",[48,551,552],{},"Generated code and SQL are validated before they run — unknown columns, invalid references, and code that doesn't compile are rejected rather than executed",[48,554,555],{},"Destructive tools are allow-listed server-side, so the model cannot reach beyond the objects a chat is scoped to",[15,557,558],{},[18,559,560],{},"AI Provider Security:",[45,562,563,566,572,579],{},[48,564,565],{},"Encrypted connections to AI providers",[48,567,568,571],{},[18,569,570],{},"We route AI requests through OpenRouter",", which forwards them to the underlying model provider (Anthropic, Google, Mistral, DeepSeek, Meta, xAI, Qwen, Moonshot and others, depending on the model you pick). OpenRouter is a sub-processor for every prompt you send.",[48,573,574,575,578],{},"We do not train any model on your data. Whether the ",[268,576,577],{},"underlying"," provider retains or trains on API traffic is governed by their terms and OpenRouter's routing policy, not ours — we do not currently set a no-retention flag on these requests. If zero-retention is a requirement for you, tell us before you send us sensitive data.",[48,580,581],{},"Data minimization (only send necessary context)",[35,583,585],{"id":584},"monitoring-and-incident-response","Monitoring and Incident Response",[40,587,589],{"id":588},"security-monitoring","Security Monitoring",[15,591,592],{},[18,593,594],{},"Monitoring:",[45,596,597,600],{},[48,598,599],{},"Structured application logging in AWS CloudWatch across every service",[48,601,602],{},"Error telemetry we review as part of normal operations",[15,604,605],{},"We do not run a SIEM, a staffed 24/7 security operations centre, or automated paging. Our metrics-dashboard and on-call stack is built but currently switched off for cost reasons, so alerting today is manual review rather than an automated page. If that matters to your risk assessment, it should — and you should ask us where it stands before you rely on it.",[15,607,608],{},[18,609,610],{},"Logging:",[45,612,613],{},[48,614,615,616,619],{},"Log retention is currently ",[18,617,618],{},"7 to 30 days"," depending on the service. We do not offer a long-lived, customer-visible audit trail yet, and permission changes are not separately audit-logged. If you need a longer retention window for compliance, tell us what you need.",[40,621,623],{"id":622},"vulnerability-management","Vulnerability Management",[45,625,626,629],{},[48,627,628],{},"Container images are scanned for known vulnerabilities on every push",[48,630,631],{},"We monitor our dependencies and apply security updates as part of normal development",[15,633,178,634,636,637,639],{},[18,635,181],{}," currently run scheduled automated vulnerability scans, and we have ",[18,638,181],{}," commissioned a third-party penetration test. We have no formal bug bounty program — but see Responsible Disclosure below; we do want your reports and will treat them seriously.",[15,641,642],{},[18,643,644],{},"Patch Management:",[45,646,647,650],{},[48,648,649],{},"We aim to ship critical security fixes quickly, and our deploy path is fast enough to do so. We do not offer a contractual patch-time SLA.",[48,651,652],{},"Rollback procedures for failed deploys",[40,654,656],{"id":655},"incident-response","Incident Response",[15,658,659],{},"Vibedasher is a small team. We do not staff a 24/7 on-call security rota, and we won't pretend otherwise. What we do commit to:",[45,661,662,668,671],{},[48,663,664,665,667],{},"We triage security reports sent to ",[29,666,32],{"href":31}," promptly",[48,669,670],{},"We classify incidents by severity and communicate with affected customers",[48,672,673],{},"We publish a post-incident summary for anything that affected customer data",[15,675,676],{},[18,677,678],{},"Breach Notification:",[45,680,681,684,687,690],{},[48,682,683],{},"We will notify affected users of a confirmed breach without undue delay, and within 72 hours where GDPR requires it. This is a commitment we intend to honour, not a record of past incidents.",[48,685,686],{},"Transparent communication about incidents",[48,688,689],{},"Post-incident analysis and improvements",[48,691,692],{},"Cooperation with law enforcement if necessary",[35,694,696],{"id":695},"compliance-and-privacy","Compliance and Privacy",[40,698,700],{"id":699},"data-privacy","Data Privacy",[15,702,703],{},[18,704,705],{},"Privacy by Design:",[45,707,708,711,714,717],{},[48,709,710],{},"Data minimization (collect only what's needed)",[48,712,713],{},"Purpose limitation (use data only for stated purposes)",[48,715,716],{},"Storage limitation (delete data when no longer needed)",[48,718,719],{},"Accuracy (ensure data is correct and up-to-date)",[15,721,722],{},[18,723,724],{},"Privacy Controls:",[45,726,727,730],{},[48,728,729],{},"Account and data deletion is available in the product today",[48,731,732,733,736,737,739],{},"Self-serve data export and portability is ",[18,734,735],{},"not built yet",". Email ",[29,738,138],{"href":137}," and we will export your data for you — the right is real even though the button isn't there yet.",[40,741,743],{"id":742},"compliance-frameworks","Compliance Frameworks",[15,745,746],{},[18,747,748],{},"Regulations we build toward:",[45,750,751,754],{},[48,752,753],{},"GDPR (General Data Protection Regulation)",[48,755,756],{},"CCPA (California Consumer Privacy Act)",[15,758,759],{},"These are the regimes our data-handling design targets. We have not been independently audited against any of them.",[15,761,762],{},[18,763,764],{},"Industry Standards:",[45,766,767,770],{},[48,768,769],{},"We write against the OWASP Top 10 — parameterized queries, output sanitisation, authorization checked server-side on every request",[48,771,772],{},"Payment card data never touches our systems: card handling is fully delegated to Stripe, which is PCI DSS certified",[15,774,775],{},"We have not formally implemented the CIS Controls or completed a NIST Cybersecurity Framework assessment.",[35,777,779],{"id":778},"on-premise-security","On-Premise Security",[15,781,782],{},"For customers using our on-premise or self-hosted deployment:",[784,785,786,800],"blockquote",{},[15,787,788,789,792,793,796,797,799],{},"Self-hosting runs from a source checkout with a Docker Compose stack and an install script — there are ",[18,790,791],{},"no published container images"," and no air-gapped distribution, so it is an ",[18,794,795],{},"Enterprise engagement scoped with us",", not a self-serve download. The installer pulls base images from public registries and needs network access. Contact ",[29,798,138],{"href":137}," to discuss your environment.",[15,801,802],{},"Note that a self-hosted deployment still requires an API key for a hosted AI provider to power the AI features — we do not ship a bundled local model.",[40,804,806],{"id":805},"installation-security","Installation Security",[15,808,809],{},[18,810,811],{},"Deployment:",[45,813,814,817,820],{},[48,815,816],{},"Containerised deployment into infrastructure you control",[48,818,819],{},"VPN or private network deployment",[48,821,822],{},"Secure default configuration, with TLS and database encryption set up as part of the engagement",[40,824,826],{"id":825},"your-responsibilities","Your Responsibilities",[15,828,829],{},"When self-hosting, you are responsible for:",[45,831,832,837,843,849,855],{},[48,833,834,836],{},[18,835,108],{},": Server hardening, network configuration, physical security",[48,838,839,842],{},[18,840,841],{},"Access Management",": User authentication and authorization",[48,844,845,848],{},[18,846,847],{},"Backups",": Regular backups and disaster recovery",[48,850,851,854],{},[18,852,853],{},"Updates",": Applying security patches and updates",[48,856,857,860],{},[18,858,859],{},"Monitoring",": Security event monitoring and incident response",[40,862,864],{"id":863},"our-support","Our Support",[15,866,867],{},"We provide:",[45,869,870,873,876,879],{},[48,871,872],{},"Security best practices documentation",[48,874,875],{},"Configuration review and recommendations",[48,877,878],{},"Security advisory notifications",[48,880,881],{},"Assistance with security incident investigation (optional)",[35,883,885],{"id":884},"team-and-physical-security","Team and Physical Security",[15,887,888],{},"Vibedasher is a small team, so we'll be concrete instead of describing a corporate security program we don't run.",[15,890,891],{},[18,892,300],{},[45,894,895,898,901,904],{},[48,896,897],{},"Access to production systems is limited to the people who need it, on least-privilege IAM roles",[48,899,900],{},"MFA on the accounts that hold production access",[48,902,903],{},"Access is revoked when someone stops needing it",[48,905,906],{},"Confidentiality agreements with anyone who has data access",[15,908,909],{},"We do not run mandatory security awareness training, phishing simulations, or background checks, and we have no badge-controlled office to describe.",[15,911,912],{},[18,913,914],{},"Data Centre Security:",[45,916,917],{},[48,918,919],{},"Entirely outsourced to AWS. Physical security, biometric access control, and environmental controls (fire, flood, temperature) are AWS's responsibility and are covered by AWS's own certifications — not ours.",[35,921,923],{"id":922},"third-party-security","Third-Party Security",[40,925,927],{"id":926},"vendor-management","Vendor Management",[15,929,930],{},"We keep the vendor list short on purpose, and we review each one's security posture and certifications before it touches customer data. We do not run a formal recurring vendor-audit program.",[15,932,933],{},[18,934,935],{},"Key Vendors:",[45,937,938,944,950,956],{},[48,939,940,943],{},[18,941,942],{},"AWS",": Infrastructure hosting",[48,945,946,949],{},[18,947,948],{},"Stripe",": Payment processing (PCI DSS certified)",[48,951,952,955],{},[18,953,954],{},"OpenRouter",": routes every AI request to the underlying model provider",[48,957,958,961],{},[18,959,960],{},"PostHog",": product analytics, including session replay on the application",[35,963,965],{"id":964},"responsible-disclosure","Responsible Disclosure",[15,967,968,969,971],{},"We welcome responsible disclosure of security vulnerabilities. We do ",[18,970,181],{}," run a formal bug bounty program with a published payout table — but we read every report and we'd rather hear from you than not.",[45,973,974,982,988,994],{},[48,975,976,979,980],{},[18,977,978],{},"Email",": ",[29,981,32],{"href":31},[48,983,984,987],{},[18,985,986],{},"Response",": we aim to acknowledge within one business day",[48,989,990,993],{},[18,991,992],{},"Rewards",": discretionary, case by case",[48,995,996,999],{},[18,997,998],{},"Credit",": happy to name you publicly, with your permission",[40,1001,1003],{"id":1002},"disclosure-guidelines","Disclosure Guidelines",[15,1005,1006],{},"Please:",[45,1008,1009,1012,1015,1018],{},[48,1010,1011],{},"Give us reasonable time to fix vulnerabilities before public disclosure",[48,1013,1014],{},"Provide detailed reproduction steps",[48,1016,1017],{},"Avoid accessing, modifying, or deleting customer data",[48,1019,1020],{},"Don't perform DoS attacks or resource exhaustion tests",[35,1022,1024],{"id":1023},"security-roadmap","Security Roadmap",[15,1026,1027,1028,1031],{},"Everything in this section is ",[18,1029,1030],{},"planned, not shipped",". It's here so you can see the direction, not so you can plan against it.",[45,1033,1034,1037,1040,1043,1046,1049,1052,1055],{},[48,1035,1036],{},"ISO 27001 certification (targeted for 2026)",[48,1038,1039],{},"SOC 2 Type II audit",[48,1041,1042],{},"Web Application Firewall and automated vulnerability scanning",[48,1044,1045],{},"Multi-factor authentication, then SAML 2.0 single sign-on for Enterprise",[48,1047,1048],{},"Longer, configurable audit-log retention, and audit logging of permission changes",[48,1050,1051],{},"Self-serve data export and portability",[48,1053,1054],{},"HSTS and a Content Security Policy on the application itself",[48,1056,1057],{},"A first third-party penetration test",[35,1059,1061],{"id":1060},"contact-us","Contact Us",[15,1063,1064],{},"For security-related inquiries:",[45,1066,1067,1074,1081,1090],{},[48,1068,1069,979,1072],{},[18,1070,1071],{},"Security Team",[29,1073,32],{"href":31},[48,1075,1076,979,1079],{},[18,1077,1078],{},"Vulnerability Reports",[29,1080,32],{"href":31},[48,1082,1083,979,1086],{},[18,1084,1085],{},"Data Protection Officer",[29,1087,1089],{"href":1088},"mailto:dpo@vibedasher.com","dpo@vibedasher.com",[48,1091,1092,979,1095],{},[18,1093,1094],{},"General Support",[29,1096,138],{"href":137},[15,1098,1099,1100,1102],{},"If you need to send us something encrypted, email ",[29,1101,32],{"href":31}," first and we'll arrange a channel.",[1104,1105],"hr",{},[15,1107,1108,21],{},[18,1109,1110],{},"Last Review:",[15,1112,1113],{},"We update this page as our practices change — including when something moves off the roadmap and into production. If anything here is unclear, or you need a control we don't yet have, please ask.",{"title":1115,"searchDepth":1116,"depth":1116,"links":1117},"",2,[1118,1123,1128,1133,1139,1144,1148,1153,1154,1157,1160,1161],{"id":37,"depth":1116,"text":38,"children":1119},[1120,1122],{"id":42,"depth":1121,"text":43},3,{"id":68,"depth":1121,"text":69},{"id":107,"depth":1116,"text":108,"children":1124},[1125,1126,1127],{"id":111,"depth":1121,"text":112},{"id":161,"depth":1121,"text":162},{"id":205,"depth":1121,"text":206},{"id":228,"depth":1116,"text":229,"children":1129},[1130,1131,1132],{"id":232,"depth":1121,"text":233},{"id":294,"depth":1121,"text":295},{"id":353,"depth":1121,"text":354},{"id":383,"depth":1116,"text":384,"children":1134},[1135,1136,1137,1138],{"id":387,"depth":1121,"text":388},{"id":434,"depth":1121,"text":435},{"id":480,"depth":1121,"text":481},{"id":535,"depth":1121,"text":536},{"id":584,"depth":1116,"text":585,"children":1140},[1141,1142,1143],{"id":588,"depth":1121,"text":589},{"id":622,"depth":1121,"text":623},{"id":655,"depth":1121,"text":656},{"id":695,"depth":1116,"text":696,"children":1145},[1146,1147],{"id":699,"depth":1121,"text":700},{"id":742,"depth":1121,"text":743},{"id":778,"depth":1116,"text":779,"children":1149},[1150,1151,1152],{"id":805,"depth":1121,"text":806},{"id":825,"depth":1121,"text":826},{"id":863,"depth":1121,"text":864},{"id":884,"depth":1116,"text":885},{"id":922,"depth":1116,"text":923,"children":1155},[1156],{"id":926,"depth":1121,"text":927},{"id":964,"depth":1116,"text":965,"children":1158},[1159],{"id":1002,"depth":1121,"text":1003},{"id":1023,"depth":1116,"text":1024},{"id":1060,"depth":1116,"text":1061},"How Vibedasher protects your data and infrastructure","md",{},true,"/security",{"title":5,"description":1162},"El7pnunApioY8p6oz3qUfddurZgykbBPf1x5RuCHghs",1788706563895]