Security posture · August 2026
Read access is a boundary, not a slogan.
Vibe Costs never requests provider passwords, payment credentials, wallet private keys, or seed phrases. Connector code performs read operations; where a provider does not offer a billing-only credential, the broader credential limitation is shown before connection.
Controls in place
What we protect today.
This list describes implemented controls. It is not a certification or a claim that any internet service is risk-free.
- 01Access
- Google, GitHub, and phishing-resistant passkeys with server-side database sessions capped at 14 days and seven days of inactivity. Sensitive controls require a fresh passkey confirmation on the current session.
- 02Credentials
- Reusable provider credentials are encrypted with authenticated encryption and remain server-side.
- 03Least privilege
- Connector code performs billing and usage reads only. We prefer provider-enforced read-only grants; when a provider requires a broader credential, that limitation is disclosed before connection.
- 04Isolation
- Application data and connector operations are scoped to the authenticated customer.
- 05Transport
- HTTPS, HSTS, content security policy, frame denial, and restrictive browser permissions.
- 06Payments
- Stripe processes payment details. Vibe Costs does not store complete card numbers.
- 07Visibility
- Customers can revoke every session and review recent sign-in, token, and connector activity.
- 08Notifications
- Security events enter a durable delivery queue. Production sign-in notices are sent through a dedicated, revocable Proton SMTP token without connector details or secrets.
- 09Release process
- Pushed revisions enter dependency audit, static checks, tests, a production build, and full-history secret scanning. VPS deployment is manual; successful-CI enforcement is not yet mechanical.
- 10Data lifecycle
- Normalized and operational records have enforced retention windows. Passkey-confirmed account deletion terminates billing before cascading tenant data from the live service.
- 11Recovery gate
- The Litestream/R2 runbook and current-canary restore verifier are implemented. Production replication remains inactive until R2 credentials are installed and a restore drill passes.
Connection policy
OAuth first. Restricted tokens second.
Our target connection sends the customer to the provider’s domain, where they authenticate and approve a narrow cost-read grant. A pasted token is a fallback only when the provider has not built delegated authorization.
Read the Open Cost Read API proposalData handling
Raw access stays out of the browser.
Only masked credential hints are displayed. Provider connections can be removed, and account data can be exported or permanently deleted from the live service. Off-server backup activation and a verified current-canary restore remain production gates.
Responsible disclosure
Found something?
Send a concise report describing the affected surface, reproducible steps, and likely impact. Do not access another customer’s data, disrupt the service, or include live credentials in the report.
Use the subject “Security report.” We will acknowledge credible reports and coordinate remediation and disclosure.
Service health: vibecosts.app/status
Machine-readable policy: /.well-known/security.txt