Security at FlexVibe

• Our pages and API work over HTTPS only, and browsers are told never to connect without it (HSTS).
• Our database (Neon) and file storage (Cloudflare R2) encrypt the data they store.
• Keys and credentials you give FlexVibe, such as your app's API keys, connector headers, Linear and Slack tokens and your app's Convex backend key, are stored encrypted with AES-256-GCM using envelope encryption: each new value gets its own data key, which is encrypted in turn with a master key kept outside the database. Each value is also tied to its workspace, so a copied value can't be decrypted anywhere else.
• Passwords are stored hashed, never in plain text.

• Sign in with an email and password, or with Google.
• Your sign-in session is kept in a secure cookie that is tied to our site and only travels over HTTPS.
• See your active sessions in Settings, and end any you don't recognize.
• Our API refuses changes that don't come from FlexVibe's own pages.
• Two-factor sign-in isn't available yet.

• Every project belongs to a workspace. On every request for a project, our servers check that you are a member of its workspace and that your role allows the action.
• The roles are Owner, Admin, Member and Viewer. Viewers can open projects and see their history, but can't run the agent or change apps.
• Teammates join a workspace by invitation, with the role an owner or admin chooses.
• Team settings show an activity log of invitations, role changes, removals and ownership transfers.
• When our own services call the agent, for example for WhatsApp or to delete a project, they use tokens that expire after 5 minutes and are limited to one user or one workspace.

• The code FlexVibe writes runs in a separate, isolated cloud environment for each project, provided by E2B, not on the servers that run FlexVibe itself.
• These environments pause when they're idle.
• Each project's code is also kept in a private GitHub repository that FlexVibe manages.

• If a message looks like it contains a secret key, such as an API key, FlexVibe doesn't send it and asks you to take the key out. The agent server runs the same check and refuses a request that contains one.
• Before the results of the agent's tools reach an AI model or the conversation history, we mask anything that looks like a secret key.
• When your app needs a key, the agent asks for it in a secure form: the value goes straight to an encrypted vault and is never shown again, and development and preview accept test keys only.
• Each time a stored key is saved, replaced, deleted or used, we record who did it and why, never the value.

• When the agent tries to run a command from our list of risky commands, such as force-pushing code, deleting folders other than build folders, dropping database tables, publishing a package or using sudo, it stops and asks you to approve, edit or reject it.
• These commands need your approval every time; “Always allow” is never offered for them.
• For some other actions you can choose “Always allow” for one project. You can review and remove these choices in the project's Permissions.
• After the agent reads outside content, such as a web page or an uploaded file, it asks you before anything that deletes, spends, publishes, reads a secret or sends data out, and ignores “Always allow” until your next message.
• The list covers the usual forms of these commands, not every possible variation, so keep an eye on what the agent does.

• Published apps are hosted on Cloudflare Pages.
• A security check runs before publishing and can stop a release when it finds a critical problem.

• Polar runs checkout and the billing portal. You enter card details on Polar's pages, so card numbers never reach FlexVibe.
• We check the signature of every payment notification Polar sends us.

• Our pages are sent with standard security headers: HTTPS only (HSTS), no embedding in other sites, and no guessing of content types.
• Our Content Security Policy is enforced on every page: your browser blocks scripts, frames and connections we haven't allowed, and reports the attempt to us.

We use PostHog for product analytics, with chat messages excluded and query strings removed from links. The Privacy policy has the details.

FlexVibe doesn't hold a formal security certification or an independent audit report yet. This page lists the controls in place today, and we'll update it when that changes.

If we find a security incident, we investigate it, contain it and fix its cause.

If it affects your personal data, we'll tell you, and the authorities where the law requires it, without undue delay.

• Email contact@flexvibe.dev with what you found, the steps to reproduce it and its impact.
• Test only with your own account and data. Don't access or change other people's data, and don't disrupt the service, for example with denial-of-service attacks, spam or social engineering.
• Give us reasonable time to fix the problem before you share it publicly. We'll confirm we received your report and keep you updated.
• If you follow these rules in good faith, we won't take legal action against you for your research.
• We don't run a paid bug bounty yet.