Responsible Disclosure

1. How to report

Email [email protected] with a clear write-up of the issue, reproduction steps, and any artifacts (videos, screenshots, scripts). We do not publish a PGP key today, so do not include live credentials or customer data in a report — describe what you reached rather than pasting it.

2. Scope

Reports are eligible if they affect:

• vibely.sh and *.vibely.sh web surfaces, including docs.vibely.sh.
• The Vibely API at api.vibely.sh.
• Preview and published app hosts at *.vibelyagent.com.
• Custom domains you have attached to a project you own.

3. Out of scope

The following are typically not eligible:

• Self-XSS, clickjacking on pages without sensitive actions.
• Reports requiring physical access to a victim’s device.
• Best-practice findings without a working proof of concept.
• Vulnerabilities in third-party services we depend on (report to them).
• Volumetric denial-of-service or social-engineering attacks.

4. Rules of engagement

While testing, you must:

• Use test accounts you control — never access another user’s data.
• Stop and report immediately if you encounter user data.
• Avoid disruption: no destructive testing, automated brute force, or large-scale scraping.
• Keep findings confidential until we publish a fix or 90 days have passed.

5. What you can expect from us

We acknowledge reports within 2 business days, share a triage update within 7 days, and aim to remediate critical issues within 30 days. We will credit researchers who request it once a fix has shipped.

6. Safe harbor

We will not pursue legal action against researchers who follow this policy in good faith. If a third party initiates action against you for activity covered by this policy, we will make our position public.

7. Bounty

Vibely runs a private bounty program for high-impact issues. Payouts depend on severity, exploitability, and quality of the report. Eligibility is at our discretion and requires compliance with this policy.