Legal

Security

Last updated October 14, 2026

We ask you to trust us with your code, so here is exactly how we handle it.

Repository access

• Read-only by default. We ask for read-only access, such as a read-only deploy key (GitHub deploy keys are read-only unless write access is explicitly enabled) or, for a repository owned by a GitHub organization, a collaborator invite with the Read role. For a deploy key we send you the public key and you add it to the one repository, so no secret changes hands. We do not ask for a collaborator invite for scan-only work: on a repository owned by a personal GitHub account, collaborators always get write access. Write access is only needed if you bought fix pull requests, and then only to the one repository. A LockedVibe GitHub App for narrower, per-repository access is planned but not yet available.
• We never need your passwords. Please don't send account passwords, and don't send secret keys by email or in the intake form.
• Revoked on delivery. When we deliver, we remove ourselves from the repository and ask you to confirm the access is gone. You can revoke it yourself at any time.

Your code

• We analyze your code with AI-powered tools in an isolated working environment used only for that job. Findings are backed by automated evidence checks; this is not a penetration test or a compliance certification.
• We delete our copy of your code when we deliver the work. For Monitor, we keep only what is needed for the recurring checks and delete it when you cancel.
• We never use your code to train AI models, and we don't share it with anyone except the providers we need to do the work.
• Our checks are non-destructive. We do not run load tests or try to change or delete data in your live app.

Secrets we find

• No secrets in reports. Exposed keys and tokens are always masked (for example sk_live_…4f2a). We tell you where the secret is and how to rotate it, not the secret itself.
• We never use a secret we find for anything other than confirming it is exposed, and we don't keep a copy.
• If we find a critical live exposure, we tell you right away instead of waiting for the report.

Personal data in your app

If your app holds personal data about its users, we may see some of it while checking whether it is exposed. We look only as far as needed to confirm the problem, we don't copy it into reports, and we treat it as confidential. If you need a Data Processing Agreement (DPA) for GDPR or similar laws, email support@lockedvibe.com and we will send one before we start.

Reporting a vulnerability

If you find a security problem in lockedvibe.com or in our work, please email security@lockedvibe.com with the details and steps to reproduce. Please give us reasonable time to fix it before making it public, and don't access other people's data or degrade the service while testing. We won't take legal action against good-faith research that follows these rules, and we'll credit you if you'd like.

See also our Privacy Policy and Terms of Service.