Skip to content
VibeBeacon
Verify us

Verify us

Check the public client packages and the site's transport settings before adding a real app. These checks do not verify private server controls.

The package that installs

Before you run anything against a real project, see the exact files that would be included in the published package, with no install happening:

bash
npm pack vibebeacon@latest --dry-run

Provenance is specific to each published version. Check that version's npm provenance panel and attestation. CLI 0.4.0 and MCP 0.4.1 were published without attestations; a newer version or workflow setting alone does not prove one exists.

bash
npm audit signatures

What provenance proves, and what it does not

A passing provenance check proves the package was built by a specific, public CI workflow, from a specific commit in a specific repository, rather than assembled and published by hand from an unknown machine. It does not prove the code is free of bugs or vulnerabilities, and it is not a substitute for reading the code or for an independent security audit. It answers one question only: did this package come from the build you can see, or from somewhere else.

The manifest before anything sends

Print the manifest before uploading. This scan does not send inventory to VibeBeacon. npx may contact npm to fetch the client before it runs:

bash
npx vibebeacon scan --json

Read the output. It should hold package names, versions and ecosystems, never file contents, source code or environment values. If it ever holds something it should not, that is a bug worth reporting.

The source

The source repository is private. You can inspect the exact release you plan to run by downloading its npm tarball, but we do not offer a public source checkout or independently reproducible build. A file listing does not prove source correspondence or build provenance.

The site itself

Run vibebeacon.app through independent scanners that grade transport and header configuration. This page does not print a number, because a number written here would go stale the moment the site changes.

  • Mozilla HTTP Observatory grades response headers such as the Content-Security-Policy and HSTS.
  • SecurityHeaders.com covers similar ground. It has no public API, so it is a link only here and is not run by our own automated check below.
  • SSL Labs grades the TLS configuration: protocol versions, cipher suites and certificate setup.

A scheduled GitHub Actions workflow runs the Observatory and SSL Labs checks weekly against vibebeacon.app and fails the build if a fetched grade drops below A. Its job summary is the number to trust, since it is fetched live rather than typed into a page. This workflow belongs to the private service repository. Visitors can use the public scanner links above. We do not provide a public checkout of the service or this job.

security.txt and reporting a problem

/.well-known/security.txt carries the disclosure contact in a machine-readable form, per RFC 9116. The full reporting process is on the security page.

What we cannot show you yet

We have not commissioned an external security audit of VibeBeacon. Public package source and transport checks do not independently verify our private server, database configuration, backups or operational controls.

See also

The full list of what VibeBeacon stores, encrypts and never sees is on the security page.