Trust

What we receive, and what we refuse

VibeBeacon is built so that a breach of our database is boring. We hold names and versions. That is the whole design, and this page shows you exactly what it looks like.

The rule we do not bend

We store package names, versions, ecosystem, framework, runtime, hosting provider and service names. Nothing else. No source code, no file paths beyond the manifest file name, no environment values, no keys, no URLs with credentials, no repository URLs, no database names.

The file

The exact JSON we receive

This is a complete manifest for a real-shaped app. Nothing else is sent, and anything extra is rejected rather than stored.

vibebeacon.json

{
  "schemaVersion": 1,
  "generator": { "name": "vibebeacon-cli", "version": "0.1.0" },
  "generatedAt": "2026-09-03T10:00:00Z",
  "app": {
    "name": "My Coffee Shop POS",
    "description": "Orders and payments for one cafe",
    "kind": "web",
    "hosting": ["vercel", "supabase"],
    "aiTools": ["cursor", "claude-code"]
  },
  "runtimes": [
    { "name": "node", "version": "22.11.0" }
  ],
  "frameworks": [
    { "name": "next", "version": "15.1.0", "ecosystem": "npm" }
  ],
  "dependencies": [
    { "name": "react", "version": "18.3.1", "ecosystem": "npm", "direct": true, "dev": false },
    { "name": "stripe", "version": "17.4.0", "ecosystem": "npm", "direct": true, "dev": false }
  ],
  "services": [
    { "name": "stripe" },
    { "name": "supabase" }
  ],
  "infrastructure": [
    { "name": "postgres", "version": "16" }
  ]
}

Field by field notes live in the manifest format reference.

Two lists

Stored and never seen

We store

Package names and the exact versions you run
The ecosystem for each package, such as npm or PyPI
Runtime and framework versions, such as Node 22.11.0 and Next 15.1.0
Hosting provider names, such as Vercel or Fly
Service names, such as Stripe or Supabase
Your email address and your app names

We never see

Your source code, not one line of it
Your .env files. The CLI refuses to open them
API keys, tokens, passwords or connection strings
File paths, repo URLs or database names
Your customers, your data or your traffic
Access to your GitHub, your host or your database

The CLI

It refuses to read .env files

This is not a policy, it is behaviour. The scanner has an allow list of files it opens.

Files it opens

package.json and the lockfile
requirements.txt, poetry.lock, uv.lock, Pipfile.lock
go.mod, Cargo.lock, Gemfile.lock, composer.lock
.nvmrc, .node-version, .python-version
Dockerfile FROM lines, vercel.json, netlify.toml

What it will not do

Open .env, .env.local or any file matching .env*, even if you ask it to
Read source files, migrations or SQL
Send file paths. Only the manifest file name travels
Send anything at all without the --upload flag

Belt and braces on our side too

Before anything is written to the database, the server scans every string for secret shapes: AWS keys, sk_live_ and ghp_ prefixes, JWT shapes, long hex or base64 runs, password= and credentials embedded in URLs. A manifest that trips any of these is rejected with an error naming the field. It is never stored, not even to log the failure.

Retention

What we delete, and when

Deletion is real deletion from the primary database. Encrypted backups roll off within 30 days.

Data	How long we keep it	When it goes
Manifests you upload	The latest 12 versions per app	Older versions are deleted nightly. All of them go the moment you delete the app.
Component list (names and versions)	While the app exists	Deleted with the app, immediately, not on a schedule.
Alerts	While the app exists, so you can see what was fixed and when	Deleted with the app.
Email delivery records	90 days	Kept only to prove an alert was sent and to handle bounces. Then deleted.
API keys	SHA-256 hash plus the first 14 characters, while the key is active	Revoke removes the hash. We never hold the key itself.
Account and email address	While your account exists	Delete your account and everything above goes within 24 hours.
Server logs	14 days	IP address and request path only. No request bodies are logged.

Your controls

What you can do at any time

See everything we hold

Each app has a page listing every component we have on file, and every manifest version we received.

Delete an app

One button. Manifests, components and alerts go with it, straight away.

Delete your account

Removes every app, every alert and your email address within 24 hours. No exit survey, no retention offer.

Turn email down

Set your severity threshold, change digest frequency, or unsubscribe from the footer of any email.

Revoke a key

API keys are shown once and stored as a hash. Revoking one stops it immediately.

Read the scanner

The CLI is open source. If you would rather check than trust, read it, or run it without --upload and look at the file first.

Housekeeping

The boring but necessary parts

Where the data lives. Postgres hosted in an Australian or Singapore region, encrypted at rest. The app runs on Vercel.

Who we share it with. Our email provider receives your address so it can deliver alerts. Stripe receives your billing details directly, and we never see a card number. Nobody else, and we do not sell or share data for advertising.

Sign-in. Passwords do not exist here. You get a magic link by email or you sign in with GitHub, and the GitHub scope covers your email address only.

Email rules. Security alerts are transactional and go to the address on your account. Anything promotional needs separate consent and has its own unsubscribe. Every email carries one-click unsubscribe headers.

Cookies. One session cookie so you stay signed in. No advertising or third-party tracking cookies.

If something goes wrong. If a breach affects your data we email you within 72 hours with what happened and what we did. Under the design above, the worst case is that someone learns which versions you run. That is still worth telling you about.