DRAFT — needs lawyer review. Describes intended practices at launch.

Security at VibeCPR

How we handle your code

Least access: read-only access to one repository, or a zip. We never ask for production secrets, service_role/secret keys or database passwords.
Sandboxed builds: your code is built inside an isolated sandbox (bubblewrap) with no network access during the build, no access to other customers' files, and a throwaway filesystem.
Passive by default: URL checks are passive. Active tests (for example, trying to read a table with your public key) run only with written authorization.
Redaction: secrets found in your app are shown masked in reports.
Human sign-off: a person reviews every critical and high finding before delivery.
Deletion: repository copies deleted within [30] days after delivery.

[security contact TBD at launch]. Please don't test against other customers' data.